Kraken's security chief says hardware wallet audits confirm a proper random number generator exists but never check whether the firmware actually calls it. That gap hid Coldcard's flaw for five years.