Back in May 2025, a security researcher reached the same conclusion while auditing the coldcard/firmware. At the time, the researcher attempted to thoroughly trace the exact source of Coldcard's random number generator (RNG) and discovered that the firmware relied on a suspicious open-source library called libngu. This project had only 6 stars on GitHub and was solely maintained by a single developer. Based on the researcher's prior experience, directly linking libsecp256k1 in Python wasn’t particularly complicated, and that seemed to be the primary purpose of this library. This raised significant doubts about the necessity of introducing libngu. The researcher then submitted a security report to the Coldcard team, expressing concerns about whether the hardware true random number generator (TRNG) was actually enabled. He specifically pointed out that the hardcoded yasmarang pseudo-random algorithm constants in libngu were handled rather carelessly. The researcher recommended completely removing the library and directly linking the official libsecp256k1. However, the Coldcard team responded by saying that if there were any issues, they would have already known about them and assured that everything was properly configured on the actual hardware. Due to the circumstances at the time, the researcher was unable to pursue the matter further, and he later regarded this as a serious lesson learned. --- Repository: https://(github.com)/switck/libngu Maintainer: Developer account switck, associated with Coinkite (manufacturer of Coldcard hardware wallets) CTO Peter Gray. Major Security Incident: This library contains low-level code used in hardware wallets/embedded devices. Security researchers analyzed the library's flaws in conditional compilation macros (e.g., random number generation TRNG/PRNG fallback logic), exposing its impact on Coldcard hardware wallet seed word entropy and related security vulnerabilities. libngu is a lightweight MicroPython Bitcoin cryptography library designed specifically for embedded hardware. It provides the cryptographic foundation and algorithm support needed to run Bitcoin on resource-constrained embedded MicroPython platforms (e.g., ESP32, STM32, etc.). The developer explicitly stated that the library focuses solely on Bitcoin and does not introduce or support any altcoins.