Very good writeup and an astonishing level of negligence for an extremely security critical piece of code. The losses are going to surpass 100 million, these guys should be thrown in jail.
I get the feeling that the bugs found in this instance can be more directly attributed to the author having zero experience operating a microcontroller
LLM agents are cheap and good enough that you can write in eg Lean or whatever. Or at least write it in Rust.