This is a guest post from noted Core-Lightning developer, ddustin , who dug into the Coldcard firmware commit history to uncover what happened and why the code failed. I began investigating the Coldcard hack and was immediately shocked. I need to explain why. When we developers work on code, we organize or code changes into changesets we call “commits.” The purpose of doing so is to show a clear history of what code was changed including why and how. This is done precisely for instances like this where it appears Bitcoiner’s funds are being stolen en masse, so we can investigate and understand exactly how it could happen. Good developers write clear commit messages, written notes that go along with the code changes that explain what the specific change is accomplishing. To make a clear commit message, you typically want to the commit to represent a smaller change of code, so there’s less to comment on. A good goal as a developer is a high commit message to change ratio.…