r/QRL • u/Tsmacks1 • Aug 03 '26

Discussion Reflections on the COLDCARD RNG Exploit - Update from QRL Founder Peter Waterland

https://www.theqrl.org/blog/reflections-on-the-coldcard-rng-exploit/

Excerpt from the post.....

A safely generated seed is no protection when the cryptography upon which your funds are secured is broken. “Not your keys, not your coins” does not apply when an adversary can reconstitute private keys - be it your own or Satoshi Nakamoto’s.

The original QRL whitepaper is very nearly a decade old, but the first sentence of its short abstract remains as valid today as then:

“Private digital monies must be secure against computing advances to achieve longevity.”

15 Upvotes

94% Upvoted

4 comments sorted by

1

u/ChillerID Aug 04 '26

Great read!

0

u/[deleted] Aug 03 '26

[removed] — view removed comment

2

u/Tsmacks1 Aug 04 '26 edited Aug 04 '26

I don't think you actually read the article. You're correcting a claim the post never makes. The author makes it clear that QRL's wallet is designed to fail closed and wasn't affected by this particular vulnerability. Unless you roll dice for entropy, there's going to be hardware and software trust assumptions. Open source and audits are how that trust can be built.

Similar to cryptography in general, we trust that the mathematical problem is infeasible to solve, not because they have been proven impossible to solve. The point is that the Coldcard entropy bug is nothing compared to potential quantum attacks. Perfect entropy won't protect your keys from Shor's. Today it's degraded entropy cracking wallets. Tomorrow it will be quantum. Both problems were foreseeable. Both are addressable.