MIT + COMMONS CLAUSE IS NOT OPEN SOURCE — COLDCARD FLIPPED THE LICENSE FOUR MONTHS BEFORE THE ENTROPY BUG THAT DRAINED 1,596 BTC. FOSS IS A SECURITY VARIABLE.
TFTC Newsdesk Aug 20 5:06 PM ET, and this needs to travel: Coldcard firmware runs under MIT + Commons Clause — a licensing structure the Commons Clause’s own FAQ explicitly labels “not Open Source.” Coinkite switched from GPLv3 to MIT + Commons Clause on November 18, 2020. Four months later, firmware v4.0.1 shipped with a seed-generation bug that reduced effective entropy from 128 bits to roughly 40 bits on Mk2/Mk3 devices. The bug sat undetected for five years. Attackers drained at least 1,596 BTC from ~7,300 addresses beginning July 30, 2026 (Galaxy Research data via CoinDesk). Largest single sweep: 1,082 BTC from 1,196 wallets in 41 minutes. First reported with the licensing framing by Bitcoin Magazine’s Juan Galt.
The distinction that matters. Publicly-readable code on GitHub is not the same as an open-source license. The Open Source Initiative’s definition and the Free Software Foundation’s four freedoms both require the right to run, study, modify, AND distribute the software commercially without restriction. The Commons Clause explicitly removes the commercial-distribution right. From the Commons Clause’s own FAQ, verbatim: “Is this ‘Open Source’? No.” Coldcard’s firmware repository at github.com/Coldcard/firmware sits under a COPYING-CC license file that codifies this. The code is publicly readable. It is not open source. That distinction is not pedantic. It is the difference between the Linux security model and the source-available security model.
Why the license affects the bug. GPL licensing gives competitors and commercial partners a direct economic incentive to audit upstream code — they are building products on it, so any vulnerability they catch protects their own product. Coinkite’s November 2020 switch to Commons Clause cut that incentive off at the source. The most motivated external reviewer Coldcard had at the time was Foundation Devices, which was actively building on the GPLv3 codebase. That commercial pressure vanished with the license change. Four months later, the entropy bug shipped. Coinkite has acknowledged they used AI to review their own code. Internal review — human or AI-assisted — does not replicate the adversarial scrutiny of commercial third parties with skin in the game. The Linux kernel is the counterexample: decades of external commercial review, funded by companies whose products depend on it, produced one of the most hardened codebases in history. Source-available produces different incentives and, over time, different outcomes.
The technical failure mode in one sentence. Firmware v4.0.1 migrated to Bitcoin Core’s libsecp256k1 library; seed generation silently fell back to MicroPython’s software pseudorandom number generator rather than the device’s dedicated hardware RNG. Two functions shared the same name; no build-time error fired. Effective entropy on Mk2/Mk3 collapsed from a 128-bit security target to roughly 40 bits — a 2^88 reduction, roughly 300 septillion times easier to brute-force. Mk4/Mk5/Q reached ~72 bits (secure element entropy mixed in), still well below standard. The bug is subtle. A meaningful external commercial reviewer with a competing hardware wallet product would have caught it. That reviewer had no license-granted right to build a competing product from the same codebase.
The falsifiable version of the thesis, honest edge. If a post-mortem shows the entropy bug pre-existed the license change, existed in the GPLv3 era, or was independently reported and ignored before November 2020, the licensing-causes-undiscovery link breaks. None of that evidence has emerged as of publication. Coinkite’s formal technical review has not been published. The broader Maximalist principle stands regardless of that specific causal chain: open source creates the possibility of verification; commercial rights are what make that verification economically rational. That is the security-model argument. It is not about Coldcard specifically. It is about every closed-source or source-available piece of software the operator class trusts with cold-storage seeds.
The Maximalist operator instruction, plain English. Before you trust a self-custody device with your bitcoin, check the firmware license. Not the GitHub repo — the LICENSE file. If the license is MIT + Commons Clause, BSD + Commons Clause, BUSL, SSPL, Elastic License, or any variant that restricts commercial redistribution, the code is source-available, not open source. The commercial-review incentive structure that catches bugs before attackers do does not fully exist. This does not mean the device is unsafe on Day 1. It means the security model over five- and ten-year horizons is materially weaker than a true GPL / MIT / Apache stack that lets competitors build commercial products on the same code and audit it as a survival function of their own business. The operator class holds bitcoin on decade timelines. The license horizon and the holding horizon have to match.
What affected users must do now. If a seed was generated on Mk2/Mk3 firmware v4.0.1 through v4.1.9, or on Mk4/Mk5/Q devices before the patched versions (Mk3: v4.2.0+; Mk4/Mk5: v5.6.0+; Q: v1.5.0Q+), migration is not optional. Updating firmware alone does not repair a compromised seed. A new seed must be generated on patched firmware and funds moved on-chain to a new address. The Coinkite security advisory at blog.coinkite.com/coldcard-mk3-seed-generation-warning documents exact version ranges and step-by-step guidance. Jonathan Goodman, a Toronto entrepreneur who lost 18.25 BTC, put it on X the day of disclosure: “Perhaps the hardest part about this is that I did everything right.” Doing everything right at the device level was not enough when the entropy was broken at the firmware level for five years.
THE LICENSE / BUG TIMELINE, DOCUMENTED
1) Mid-2020: Coldcard firmware = GPLv3. Commercial audit incentives fully aligned.
2) Nov 18, 2020: Coinkite switches to MIT + Commons Clause. Commons Clause removes commercial redistribution right. External commercial reviewer incentive cut.
3) March 2021: firmware v4.0.1 released with libsecp256k1 migration. Seed generation silently falls back to MicroPython software PRNG instead of hardware RNG. Two functions share the same name; no build-time error. Effective entropy Mk2/Mk3: ~40 bits (vs 128 target). Mk4/Mk5/Q: ~72 bits.
4) 2021 - July 2026: bug undetected for ~5 years. Coinkite uses AI-assisted internal review; misses it.
5) July 30, 2026: attackers begin sweeping. Largest single sweep: 1,082 BTC from 1,196 wallets in 41 minutes.
6) Aug 2026: Galaxy Research (via CoinDesk) puts high-confidence damage at 1,596 BTC from ~7,300 addresses. Other estimates run higher.
7) Licensing structure that catches this: true FOSS — GPLv3, MIT without Commons Clause, Apache 2.0 — grants commercial redistribution and creates the adversarial-review incentive.
8) Licensing structures that don’t: Commons Clause variants, BUSL, SSPL, Elastic License, closed source with public repository.
9) First reported with the licensing framing: Bitcoin Magazine, Juan Galt, Aug 20 2026. Foundation CEO Zach Herbert documented the timeline in detail on X.
10) Coinkite advisory: blog.coinkite.com/coldcard-mk3-seed-generation-warning
2) Nov 18, 2020: Coinkite switches to MIT + Commons Clause. Commons Clause removes commercial redistribution right. External commercial reviewer incentive cut.
3) March 2021: firmware v4.0.1 released with libsecp256k1 migration. Seed generation silently falls back to MicroPython software PRNG instead of hardware RNG. Two functions share the same name; no build-time error. Effective entropy Mk2/Mk3: ~40 bits (vs 128 target). Mk4/Mk5/Q: ~72 bits.
4) 2021 - July 2026: bug undetected for ~5 years. Coinkite uses AI-assisted internal review; misses it.
5) July 30, 2026: attackers begin sweeping. Largest single sweep: 1,082 BTC from 1,196 wallets in 41 minutes.
6) Aug 2026: Galaxy Research (via CoinDesk) puts high-confidence damage at 1,596 BTC from ~7,300 addresses. Other estimates run higher.
7) Licensing structure that catches this: true FOSS — GPLv3, MIT without Commons Clause, Apache 2.0 — grants commercial redistribution and creates the adversarial-review incentive.
8) Licensing structures that don’t: Commons Clause variants, BUSL, SSPL, Elastic License, closed source with public repository.
9) First reported with the licensing framing: Bitcoin Magazine, Juan Galt, Aug 20 2026. Foundation CEO Zach Herbert documented the timeline in detail on X.
10) Coinkite advisory: blog.coinkite.com/coldcard-mk3-seed-generation-warning
UPDATE — FRI AUG 21 · 8:35 AM ET
Coinkite shipped patched firmware three weeks after disclosure. Coldcard Mk4/Mk5 firmware 5.6.1 and Q model 1.5.1Q per CoinDesk (Shaurya Malwa, Aug 21 12:10 PM ET). Coinkite says AI tools (Kimi + frontier models) audited the whole codebase and surfaced additional problems in transaction approval flow, USB data handling, and firmware update validation — unrelated to the original entropy bug. New seeds now require physical randomness: 65 key presses at unpredictable intervals, 50 dice rolls, or 128 coin flips. Backup RNG replaced (Yasmarang → SHA-256). Compromised wallets still need new seeds and on-chain fund migration; the firmware update alone does not save affected users.
The framework read on the framework read: the bug that cost users $114 million was one the audit process before it missed. Same defense — audit rigor — is now the marketing angle. This UPDATE reports the ship as news. It does not upgrade the recommendation. Broader context: BTCPay ($130M lost to hot Lightning nodes), Bitcoin Red Team (85 critical + 635 high-severity bugs in 24 hours across 390 projects), Bybit ($700M in blocked withdrawals). The security posture across BTC infrastructure is being rebuilt live under AI pressure. Operator instruction from the pre-UPDATE body stands: check the LICENSE, not the repo; match license horizon to holding horizon; a firmware ship does not reset a compromised seed. Source: coindesk.com/tech/2026/08/21/coldcard-ships-firmware-after-usd114-million-bitcoin-theft-says-ai-helped-catch-more-bugs (Malwa, Aug 21 12:10 PM ET).
The framework read on the framework read: the bug that cost users $114 million was one the audit process before it missed. Same defense — audit rigor — is now the marketing angle. This UPDATE reports the ship as news. It does not upgrade the recommendation. Broader context: BTCPay ($130M lost to hot Lightning nodes), Bitcoin Red Team (85 critical + 635 high-severity bugs in 24 hours across 390 projects), Bybit ($700M in blocked withdrawals). The security posture across BTC infrastructure is being rebuilt live under AI pressure. Operator instruction from the pre-UPDATE body stands: check the LICENSE, not the repo; match license horizon to holding horizon; a firmware ship does not reset a compromised seed. Source: coindesk.com/tech/2026/08/21/coldcard-ships-firmware-after-usd114-million-bitcoin-theft-says-ai-helped-catch-more-bugs (Malwa, Aug 21 12:10 PM ET).
Publicly readable is not open source.
Open source is not a nice-to-have; it is the incentive structure that pays for the audit.
The license and the holding horizon have to match.
The cap is still twenty-one million.
Open source is not a nice-to-have; it is the incentive structure that pays for the audit.
The license and the holding horizon have to match.
The cap is still twenty-one million.
TFTC Technology · TFTC Newsdesk · Aug 20 2026 5:06 PM ET · Primary sources: Coinkite Security Advisory, Coldcard COPYING-CC license file, Commons Clause FAQ, Galaxy Research via CoinDesk, Bitcoin Magazine (Juan Galt) first-reporting the licensing framing, Zach Herbert (Foundation) X timeline