The weirdest part of the ColdCard mess: Peter D. Gray (aka "doc-hex")

[Stalker22]

Honestly, I still cant wrap my head around this whole Coldcard situation.  We spent years telling people that open-source code is our best line of defense and advocating for a full public commit history, but then you try to look under the hood of what actually went down here, and it feels less like a serious engineering setup and more like a lame, amateurish one-man theater show.

Beyond the actual RNG vulnerability that hit the firmware, the weirdest part of this entire story is the strange relationship between Coinkite's co-founder and CTO, Peter D. Gray (DocHex), and a pseudo-anonymous developer named "switck".

Here is a link to a discussion I came across on the r/Bitcoin board, but to keep it simple, here is a quick AI-assisted recap with links to some external sources:

“Switck” is an online alias and GitHub account heavily scrutinized in the recent Coldcard security controversy, with cryptographic proof showing it was operated by Coinkite CTO Peter D. Gray.

The "Switck" and Peter D. Gray Connection

• Shared GPG Keys: An analysis of Git commits in the switck/libngu repository revealed 58 commits authored by "Switck" that were cryptographically signed using Peter D. Gray's personal GPG key (peter@conalgo.com).^[1][2]
• Overlapping Timelines: Gray's real-name identity and the "Switck" alias signed commits and interacted in overlapping periods.
• Public Self-Interaction: Under the u/switck social media and GitHub handles, Gray appeared to announce his alias as a "new identity" and later publicly thanked his own primary developer account (doc-hex) or promoted code libraries as though they belonged to an independent third party.^[3]

Connection to the Coldcard Vulnerability

• The Code Timeline: In early 2021, code under the switck alias introduced a defective feature check into libNgU.
• RNG Path Switch: Shortly after, Peter Gray's primary developer alias (doc-hex) imported that code, disabled hardware random number generation, and routed master-seed generation to the flawed path.
• The Fallout: This vulnerability eventually surfaced during investigations into major security and seed-generation flaws impacting certain hardware wallet firmware versions.^[4]

What do you make of all this?  Was this just bizarre ego and messy developer habits, or was there something much more calculated about keeping libngu - a core cryptographic library - on a personal account instead of under the official organization?  Why would a lead developer set up an alter ego to approve and maintain their own code?

[1] - switck == doc-hex: proven by GPG commit signatures
[2] - was Peter D. Gray talking to himself through “switck”? : r/Bitcoin
[3] - Inside job? The “bug” conveniently originated in 2021 : r/coldcard
[4] - Retirement Attack: Many more details pointing straight to the CEO and CTO stealing the coins : r/Bitcoin

[dkbit98]

We spent years telling people that open-source code is our best line of defense and advocating for a full public commit history, but then you try to look under the hood of what actually went down here, and it feels less like a serious engineering setup and more like a lame, amateurish one-man theater show.

I don't know what open source code have to do with c0dlcard when they are not open source for a long time.
In fact this bug or intentional mistake was introduced on the day when they stopped being open source, and tried inventing wheel all over again.

[Stalker22]

We spent years telling people that open-source code is our best line of defense and advocating for a full public commit history, but then you try to look under the hood of what actually went down here, and it feels less like a serious engineering setup and more like a lame, amateurish one-man theater show.

I don't know what open source code have to do with c0dlcard when they are not open source for a long time.
In fact this bug or intentional mistake was introduced on the day when they stopped being open source, and tried inventing wheel all over again.

Coldcard was "source-available", and people were literally calling it open source for years.  Thats the entire point.

The flaw wasnt hidden in some locked-down, closed source/proprietary code, it was sitting right there in the GitHub repo, and it still went completely unnoticed until people started losing money.  From what I have read, it seems that Peter D. Gray used the fake identity "switck" to review his own code, praise his main account, and pretend independent developers were backing his work.  So the problem wasnt closed source; it was sheer arrogance and/or incompetence of Coinkite founders and developers.

[flatt]

Although it's been explained everywhere,

There is no weirdest part when the bug available for 5 years even though some high-level researcher warned them because ColdCard is open-source.

What's left is only their Developer cold-frozen headbrain and nothing they can do except watching their users losing their money because there's no way to revert it.

[dkbit98]

Coldcard was "source-available", and people were literally calling it open source for years.  Thats the entire point.

This is not true and you should not talk about something you don't know anything about.
nvk scammer c0ldcard develoer lied for months and years they are open source, and I proven that many times in forum if you care to look at history.
Independent developers don't have any incentive whatsoever to check or submit any commits for not-open source projects, and nvk and his clown developers are a joke.
RIP c0ldcard crap.

[tbct_mt2]

Coldcard was "source-available", and people were literally calling it open source for years.  Thats the entire point.

If people are confusing about it, it's their responsibility and they must change themselves.

Similarly, there are still many people who believe in advertisement of Binance and Trust wallet so they think Trust wallet is open source while that wallet has never been open-source. About Trust wallet and its close source, there are many posts, reminders about that, so if people still believe Trust wallet is open-source, what the others can do for enlightening such people.

The flaw wasnt hidden in some locked-down, closed source/proprietary code, it was sitting right there in the GitHub repo, and it still went completely unnoticed until people started losing money.

Very similarly to Trust wallet's close source technically, there are warnings about weak entropy generated by Coldcard hardware wallet, but the hardware wallet manufacturer ignored about that, people in the community mostly ignored about that too. I know such warnings about Coldcard's weak entropy were not too popular but there were still some in past years until this massive hack.

[MoparMiningLLC]

Coldcard was "source-available", and people were literally calling it open source for years.  Thats the entire point.

At one point they were open source but once foundation used their code they went to "source-available" they did not like Foundation "copying" their code which is kind of hypocritical since they (coldcard) copied Trezors.

[Stalker22]

Coldcard was "source-available", and people were literally calling it open source for years.  Thats the entire point.

At one point they were open source but once foundation used their code they went to "source-available" they did not like Foundation "copying" their code which is kind of hypocritical since they (coldcard) copied Trezors.

Yeah, I know about that.  The ultimate irony, right?  They loved the "open source" label when it meant free labor and free code for them, but hated it the second someone else does the exact same thing.

That is exactly why I even started this thread.  To discuss this.  So why the hell was Peter D. Gray wasting time building fake sockpuppet accounts on GitHub and X to talk to himself and to review and sign off on his own commits instead of actually building an open, independent developer community?

[MoparMiningLLC]

maybe he made the accounts so he could invoice coldcard for the work that the "other" guy did? whereas if "he" himself did it, it would just be considered paid under his salary?

essentially - just greed.

[DireWolfM14]

you should not talk about something you don't know anything about.

Why?  You do it all the time.  And here you go again, spreading misinformation about technical topics of which you have no understanding.  The only reason you've had a bug up your ass about ColdCard all these years is because nvk was one of the first people on this forum to expose you for the mental midget you are.

ColdCard's firmware is licensed under Common Clause.  It's available for review, just like Stalker22 said.  It's not legally permissible to copy or clone it for commercial purposes.  But, anyone who wants to can review it and validate it.

So, shut the fuck up and let the adults in the room decern what went wrong, and how to avoid it the next time.

[dkbit98]

maybe he made the accounts so he could invoice coldcard for the work that the "other" guy did? whereas if "he" himself did it, it would just be considered paid under his salary?

Do you still own any c0oldcard devices?
I heard some people starting installing custom firmware on their devices and using it for different purposes, even for coijnoin.
Maybe it can finally work as real calculator or for playing some simple retro games.

[MoparMiningLLC]

maybe he made the accounts so he could invoice coldcard for the work that the "other" guy did? whereas if "he" himself did it, it would just be considered paid under his salary?

Do you still own any c0oldcard devices?
I heard some people starting installing custom firmware on their devices and using it for different purposes, even for coijnoin.
Maybe it can finally work as real calculator or for playing some simple retro games.

I kept all of mine - but never actually used them - they simply exist as part of my collection. The only thing really missing from my coinkite collection is the very first opendime version (I had one at one point I swear but I cannot find it now) and a couple of the event satscards - maybe like 3 or 4

[SensitiveEyes]

The flaw was from March 2021 in firmware version 4.0.0. Not hidden but independent developers did not notice the weakness to bypass its random chip for generating keys. Hackers discovered the firmware used a software substitute which made it possible to guess seeds phrases. 5200 addresses were hacked after 128 bits security became 40 bits.

On 29 July hackers stole $1.6m from a user who put his Coldcard with 18.25245043 bitcoin in a safety deposit box. They stole 1816 bitcoin worth $116m since 30 July. Coldcard's CEO Rodolfo Novak blames AI for finding ways to hack the firmware so he asked Coldcard users to migrate their bitcoins. Rodolfo's late advice came after millions were hacked.

[DireWolfM14]

~

This isn't the sports gambling section, and we don't need your AI generated play by play recap sig spam.

[tvbcof]

maybe he made the accounts so he could invoice coldcard for the work that the "other" guy did? whereas if "he" himself did it, it would just be considered paid under his salary?

Do you still own any c0oldcard devices?
I heard some people starting installing custom firmware on their devices and using it for different purposes, even for coijnoin.
Maybe it can finally work as real calculator or for playing some simple retro games.

(Thread-watching mostly, but) I would mention that the 'retro game' vid I saw seemed to be a faked vid due to the colored screen.