According to CoinMeta, the Coldcard hacker attack revealed that reputation is not a reliable security measure. Attackers stole nearly $114 million in Bitcoin from over 709 addresses, taking advantage of the insufficient randomness of the mnemonic phrases generated by a Coldcard firmware vulnerability. The first attack emptied about 500 wallets within 25 minutes. This vulnerability has been in the codebase since March 2021 and has been publicly visible for over five years. Although many people have tried to explain what happened, the more difficult question is why no one discovered it, and the answer involves more than just a single line of code. The source code for Coldcard has always been available for inspection; the principle of “don’t trust, verify” only works when qualified personnel actually examine it, yet in the past five years, virtually no one has done so.