A firmware build from March 2021, Coldcard, routed key generation through a software randomizer instead of the hardware one. Bounded keyspace, reproducible offline by anyone with the disclosure and enough compute. 4,585 addresses swept so far, near $89 million. Not a break in the signature scheme. A break in the coin flip before it. The lesson was always the same: the weak link is wherever a human, or a shortcut, decided randomness was someone else's problem.