Bitcoin wasn't broken. The random key generation was. The Coldcard lesson everyone should understand

To explain the Coldcard disaster as simply as possible, imagine you have 3 billion grains of sand, and one grain is marked.

If I ask you to find the marked grain, you have to search through billions of grains. Pretty difficult.

Now imagine I make a mistake and tell you that the marked grain is actually somewhere among only a few hundred grains.

Suddenly, finding it is easy. You just check the few hundred grains one by one.

That is basically what happened with the Coldcard vulnerability.

A Bitcoin private key is normally chosen from an unimaginably huge number of possibilities. The whole point is that nobody can realistically search through them all.

But because of a bug, some Coldcard devices could generate keys from a much smaller and predictable set of possibilities than they should have.

So an attacker didn't have to search through the entire universe of possible Bitcoin keys. They could concentrate on this much smaller set and test the possibilities against the blockchain.

With a powerful computer, they could eventually find the private key and steal the Bitcoin.

So the simple version is:

Billions of grains = practically impossible to search.
A few hundred grains = easy to search.

The security wasn't broken because Bitcoin's cryptography was cracked. The problem was that the key was generated from a much smaller pool of possibilities than it should have been.