WIZARD SARDINE: ONE CHARACTER STOOD BETWEEN THE SAFEGUARD AND THE DRAIN. POST-MORTEM SHIPS.

Kevin Loaec, co-founder of Wizard Sardine and one of the first to publicly raise the alarm on the ColdCard drain, has now published the definitive independent forensic post-mortem of the RNG collapse. The finding is precise and unforgiving: a single character in a build flag — a check that tested whether the setting existed rather than whether it was switched on — silently routed key generation through a software PRNG for five years. The hardware TRNG the device advertised was still in the codebase. It just wasn’t being called for the part of the process that actually needed randomness.

The scope Loaec walks through is wider than the initial Mk3 advisory. Mk2, Mk3, Mk4, Q, and Mk5 seeds generated on affected firmware are all in the exposure window. Passphrase-free single-sig setups are the most immediately at risk. Multisig setups built from affected devices should be treated as exposed too, not just single-sig wallets — if the quorum is entirely ColdCard-derived, the compromise of individual keys collapses the multi-key safety margin. Loaec’s guidance is direct: if you hold funds on a passphrase-free affected seed, do not wait for further disclosures. Migrate to new seeds generated on patched or different hardware, and move funds.

The Technologist read: this is the sovereignty-tooling class doing what it exists to do. Loaec did not need to wait for Coinkite’s official post-mortem to publish his own — he pulled the codebase, traced the failure back to the specific build-configuration mistake, and put the receipt on the table while the drain was still unfolding. The security floor for every hardware wallet vendor downstream is now higher than it was on Friday. That is what a working sovereignty layer looks like. The network did not fail. A product at the edge failed, and the community-run security research class caught it and documented it in real time.