Laser on Nostr: NVK indicated to Matt Odell that he wouldn't share the details of the bug in 4.0.0 ...

NVK indicated to Matt Odell that he wouldn't share the details of the bug in 4.0.0 because it would allow Odell to "steal all your Bitcoin", according to Odell.

Many claim that Odell was referring to a bug in 4.0.0 that was patched in 4.0.1 which accidentally left the debugging interface enabled (USB serial REPL), which would allow an attacker with physical access to customer coldcards to extract it's secrets.

But Odell wouldn't have physical access to customer coldcards, so NVK must have accidentally been referring to Peter Gray's exploit which also shipped in 4.0.0, which *would* allow anyone with knowledge of the exploit to "steal all your #Bitcoin".

quoting
nevent1q…ra99

Matt Odell and Marty Bent discuss #Coldcard's 4.0.0 firmware shortly after it's release.

This release is now known to have distributed the vulnerability Coinkite CTO authored under an alias that later lead to the theft of $100m+ of #Bitcoin in July/August 2026.

The following clip is taken from their podcast titled "Rabbit Hole Recap: Bitcoin Week of 2021.03.29" from timestamp 1:25:09 to 1:26:21.