Over $100M in Bitcoin vanished from hardware wallets — no phishing, no malware, nobody touched a device. Just a broken random number generator that sat in open-source code for five years.
Matty sits down with Dr. Francesco Madonna — physician, former military medical officer, and founder/CEO of BitVault — to break down exactly how the Coldcard entropy failure worked, why "random" wasn't random, and what it means for the future of self-custody.
Francesco also walks through his own near-miss with a physical attack scam, and how it led him to build a wallet where a stolen seed phrase still can't drain your funds — using on-chain time-locks and 2-of-3 multisig that always give the real owner priority over the attacker.
In this episode:
• How a single build flag turned "random" seeds into guessable ones
• Why hardware wallets were never the whole story
• Time-locked vaults, explained (the 80-year-old bank tech behind them)
• Open source vs. closed source after a 5-year public bug
• Francesco's Dubai-diamond-dealer scam story (and why he moved countries)
• The 60/20/20 self-custody debate: are you a self-custody maxi?
⏱️ Chapters
00:00 Cold open
01:15 Dive in — what happened with Coldcard?
01:55 The RNG that was disconnected
02:36 The unvetted library & the ignored warning
03:02 "Less bits of entropy" — the seed phrase problem
03:42 1-to-100 vs 1-to-5: why randomness matters
04:36 Is your crypto safe? A dark week for self-custody
~09:00 Are you a self-custody maxi?
~14:00 Don't put all your eggs in one basket (the 60/20/20)
~22:00 Insurance, Coinbase vaults & Anchor Watch
~26:00 Time locks explained — the bank vault analogy
~34:00 The A/B/C multisig & why the user always has priority
~46:00 Open source vs closed source after the breach
~50:00 AI in wallet security / the red team
51:07 Lugano & Plan B
51:41 Final advice: self-custody didn't fail
53:59 Wrap & BitVault plug
54:25 Outro — cypherpunk manifesto quotes
🔐 Check out BitVault: https://bitvault.sv | @BitvaultApp
🎙️ Guest: Dr. Francesco Madonna — https://x.com/CiccioMadonna
🐇 Subscribe to Cypherpunk'd and head down the rabbit hole.
⚠️ Not financial advice. Do your own research.