scary thought experiment: if coldcard had found this exploit themselves, how could they have fixed it without instantly putting all of their customers’ coins at risk? patching the firmware wouldn’t fix vulnerable seeds, and the moment they emailed customers (assuming they hadn’t purged records) or released the patched firmware this would have alerted hackers to the exploit and begun draining wallets one of the only ways to have saved vulnerable coins would have been to alert a whitehat group before any public disclosure who could preemptively seize vulnerable coins and then let people provide non-cryptographic proof of ownership, which would have been a complete mess, invited massive lawsuits, and likely an impossible task unless they had used a kyc exchange to purchase the coins (for non-kyc apparently some form of device verification might be possible but unclear)