ColdCard leaked 1,600 BTC because `#ifndef` passed on a flag set to zero.

Fireship walked through it August 5. ColdCard's firmware runs MicroPython, whose weak RNG was supposed to be disabled by setting a flag to 0. Both RNGs exported the same function name, and the crypto library chose between them with an if-not-defined check. The flag was defined. As zero. For five years every seed phrase came from MicroPython's RNG, which on bare metal falls back to chip serial plus a timer, both deterministic, collapsing 128 bits into brute-forceable space. Since July 30 attackers have drained 1,600+ BTC (~$400M) from 7,000+ wallets. No malware, no phishing. Victims are now bidding against attackers to buy back their own coins.