Every one of these was a well-regarded product built by competent people. That is the point.
A firmware build guard checked whether a macro existed rather than whether it was enabled. The crypto library bound to what it believed was the hardware TRNG while the runtime had compiled in a software fallback seeded from a chip ID, a timer, and RTC registers that are frequently static on cold boot. Effective entropy: roughly 40 bits instead of 128.
Attackers enumerated the space and matched addresses on-chain. Around 594 BTC — $38–40M — left in a single 25-minute sweep. The bug shipped in March 2021 and went undetected for five years. Users who supplied their own dice entropy or a passphrase were unaffected.
A weak PRNG with a 31-bit initial state, seeded from a guessable timestamp, in the WASM build. Every wallet the extension created was remotely brute-forceable with no user interaction. Trust Wallet Core is one of the most widely deployed multi-chain key libraries in existence, and it shipped this anyway.
A vanity-address generator drawing from a bounded seed space. Roughly $160M taken from Wintermute alone.
A browser RNG failure that produced duplicate keys across different users.
Four unrelated technology stacks. The same failure.
Embedded C firmware. WASM in a browser extension. A native command-line tool. Client-side JavaScript. You cannot avoid this bug class by picking a different language or a better library. It lives in the seam where one component assumes another is supplying good randomness and nothing ever checks.
Every one of them also failed quietly. That is why this stick refuses to generate rather than falling back, and why your own entropy is mixed in on top — because in the only case where a defence worked, that was the defence.