• The vulnerability stemmed from a faulty flag check in the firmware, which forced the system to rely on a basic MicroPython generator that used only chip serial numbers and timers to 'randomize' inputs.1:55
• Because these inputs were deterministic and enumerable, attackers were able to brute-force the keys of thousands of users who had previously assumed their assets were secured by high-entropy, offline generation.2:45
• Victims attempting to save their funds faced a secondary threat: attackers monitored the public mempool for rescue transactions, then broadcasted their own competing transactions with higher fees to steal the remaining coins before they could reach a new, secure wallet.3:30
• The only viable rescue path was to bypass the public mempool entirely by sending funds directly to a mining pool, a workaround that relied on centralized coordination to outmaneuver the exploit.
• CoinKite, the Canadian manufacturer of the device, has acknowledged the flaw and halted shipments of all remaining warehouse inventory, which was confirmed to contain the same broken firmware.4:05

Developer Demo

• In a separate segment, the narrator demonstrated using Lovable—an AI development platform—to build a predictions market, noting that the tool successfully managed payments and a Postgres database despite hitting a policy-related bug that required reverting to 'plan mode' to resolve.