Trezor's CTO on the Cold Card Hack: Randomness, Trust, and What Comes Next - Tomáš Sušánka | Ep. 153

Tomáš Sušánka is the CTO of Trezor, where he has worked since 2017. Tomáš joins Efrat for an urgent, unscripted conversation days after the Cold Card hardware wallet hack, in which a flawed random number generator left seed phrases vulnerable and resulted in more than 1,500 bitcoin stolen from affected users. Drawing on questions submitted directly by the Bitcoin community, Tomáš walks through what entropy actually is, how Trezor's own four-source random number generation works, why open-source visibility alone does not guarantee security, and what practical steps everyday self-custody users can take to reduce how much they have to trust any single piece of hardware. 

→ Please like, comment, share & subscribe, to help me beat the suppressing algo's. Thank you!

– SPONSORS –

→ Get your TREZOR wallet & accessories, with a 5% discount, using my code at checkout (get my discount code from the episode - yep, you’ll have to watch it): https://affil.trezor.io/SHUn

→ Download the free report on second citizenships & setting up a plan B in another country with Expat Money: https://expatmoney.com/efrat

→ Access liquidity without selling your Bitcoin with Ledn, get 0.25% off your first loan: https://ledn.io/Efrat    

→ Have you tried mining bitcoin? Stack sats directly to your wallet while saving on taxes with Abundant Mines: https://AbundantMines.com/Efrat - Claim your free month of hosting via this link

– AFFILIATES –

→ Get 15% off “Born To Be Free” all-natural, tallow-based skincare products on a bitcoin standard, using code EFRAT: https://oshi.link/1nvZYq  

→ Join me in these upcoming events & use code EFRAT for discounted tickets: https://www.efrat.blog/p/upcoming-events

→ Get 10% off on Augmented NAC to detox Spike protein, with the code YCXKQDK2 via this link: https://store.augmentednac.com/?via=efrat (This is not medical advice, please consult your MD)

→ Watch “New Totalitarian Order” conference with Prof. Mattias Desmet & Efrat - code EFRAT for 10% off: https://efenigson.gumroad.com/l/desmet_efrat

– LINKS –

Tomáš on X: https://x.com/tsusanka

Tomáš on LinkedIn: https://www.linkedin.com/in/tsusanka/

Efrat’s X: https://twitter.com/efenigson

Efrat’s Channels: https://linktr.ee/efenigson

Watch on all platforms: https://linktr.ee/yourethevoice

Support Efrat’s work: ⁠https://bit.ly/zap_efrat

– CHAPTERS – 

00:00 - Introduction: Tomáš Sušánka, Trezor CTO

02:39 - What Happened with Cold Card: How Trezor Received the News

09:17 - Origins of Cold Card: Forks, Licensing, and the Bitcoin-Only Split

13:40 - Open Source vs. Source-Available: How the Bug Went Undetected for Five Years

20:20 - Trezor's Response: Security Reviews and R&D Changes Since the Incident

22:24 - How Trezor Generates Randomness: The Four Entropy Sources

23:29 - Dice Rolling for Seed Generation: Necessary?

28:30 - Reducing Trust: Practical Verification Steps 

31:09 - Single Device vs. Multisig

32:45 - BTC Sessions Clip: Ben and Nathan on Air-Gapped Wallets

34:29 - Tomáš's Take: Why Air-Gapping Isn't What People Think

39:49 - How Trezor's Design Differs from Cold Card's

42:32 - 2026 Secure Element Laser Fault Injection Finding

47:46 - Responsible Disclosure: Trezor's Protocol for Reporting Vulnerabilities

49:29 - The Biggest Risks Facing Bitcoin Right Now

51:01 - Short-Term Damage vs. Long-Term Lessons for the Community

55:27 - Trezor Model One's 12th Anniversary and the Evolution of Hardware Wallets

57:57 - Closing Thoughts and a Call for Continued Security Research