Nobody can measure how much licensing pressure shaped the scope or speed of that rewrite, and the overhaul also pursued legitimate technical goals. The documented facts are narrower and still damning: a license change made to restrict competitors preceded a rushed replacement of battle-tested cryptographic code, and the replacement contained the flaw now draining wallets. Free and open-source software principles exist precisely to keep security from depending on any one company’s choices. Those principles cannot come with a personality exception.
Zach Herbert is co-founder and CEO of Foundation.
Researchers learned not to look
The deeper failure is what happened to the people who did look. In August 2020, researchers from Shift Crypto and Nunchuk disclosed a multisig verification flaw in Coldcard. Coinkite acknowledged the bug and shipped a fix, and NVK, on the Citadel Dispatch podcast simultaneously branded the disclosure “PR…
