Coldcard’s $116M exploit sparks dispute over prior security reviews

By Marcus Bennett

TRM Labs estimated that attackers stole roughly $116 million in Bitcoin through a seed-generation flaw in Coinkite’s Coldcard hardware wallets. The estimate covered about 1,816 BTC stolen from more than 5,200 addresses, according to TRM’s Aug. 5 analysis, which cited Galaxy Research’s running tally. The analysis traced four theft waves beginning July 30.

The March 2021 build configuration error selected a weak software random-number generator. On older devices, effective seed strength fell to as little as 40 bits, against an intended 128. Attackers could reconstruct private keys without physical access.

An August investigation update said information about the attacker had been passed to U.S. authorities. Galaxy’s Alex Thorn said an identity “may be known to law enforcement,” but the reporting did not establish a confirmed FBI identification or recovery.

Did human reviewers miss the Coldcard defect?

Coinkite CEO NVK defended the company’s security record on Nov. 9. He argued that a new AI model found a defect human reviewers had missed. He said at least 15 external reviews or research efforts had touched Coldcard before the flaw emerged.

NVK said the work covered the hardware, firmware, tools connected to random-number generation and release controls. He cited two paid third-party product reviews. One examined Mk4 in 2022, and another covered Q in 2024.

He also cited Rob Ham’s OpenAI Cybersecurity Harness, which produced 85 candidate findings before the incident. Several prompted fixes, he said, but the seed-generation defect was absent.

NVK wrote: “The uncomfortable truth is that it took a new AI model to find what humans couldn’t.”

What does the dispute over earlier warnings mean?

Bitcoin developer Luke Dashjr rejected the suggestion that human review could not uncover the problem. He said he had privately shared findings with Coinkite and was now disclosing them publicly.

Dashjr also limited his claim. He described his examination as a quick look, not a full audit or extensive review of the code. He was not saying every issue he raised was definitely a bug or could be exploited.

His central objection was narrower. NVK’s assertion that only a sophisticated AI model could identify problems with the random-number generator was false.

Did researchers raise concerns before the exploit?

James O’Beirne’s older posts resurfaced in the exchange. In an Aug. 4 post, he said he began examining Coldcard’s firmware in May 2025 to establish where its random-number generator obtained entropy.

He questioned the use of the libngu library, raised concerns about hardcoded constants in its software fallback and recommended linking directly against libsecp256k1. According to his account, he was told the configuration was correct for physical devices and a problem would already have become apparent. He acknowledged that he did not pursue the matter rigorously.

In an Aug. 5 follow-up, O’Beirne said he had received another credible account of a warning from 2021. That account was separate from a Telegram discussion he had shared earlier. His suggestion that three people may have warned Coinkite remains his account of those communications.

Other participants pressed Coinkite on its handling of scrutiny. Alex Waltz accused the company and NVK of discouraging people from examining the code. Kenneth said ongoing quality assurance differed from asking a team to review an entire codebase.

Shinobi defended NVK, arguing that reviewers had examined the entropy system without identifying the defect. He challenged critics to produce a reproducible failure, saying a private message expressing concern was not equivalent to a security disclosure.

Where did the attacker’s funds go?

September reporting, previously carried by crypto.news, said Galaxy’s Alex Thorn tracked a third-wave attacker swapping roughly 10% of that attacker’s Bitcoin through THORChain into Ether. Most of the attacker’s funds remained unmoved at the time.

What does this change for Coldcard users?

Coinkite’s current security page calls its published record a living postmortem. Coinkite says a separate detailed technical report remains in preparation. The page distinguishes targeted independent checks from a complete audit of every corrected firmware binary.

The listed work includes hardware randomness testing, source reviews and a reproducible build. Current recommended standard releases are 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q.

For affected users, the practical answer is blunt: a firmware update cannot repair existing affected seeds. Coinkite advises generating a new seed, making a verified backup, checking the receiving address, sending a small test transfer and then moving the remaining funds.

The market’s structural test is whether buyers treat targeted checks as a substitute for comprehensive audits of every corrected firmware binary. Coinkite’s pending technical report is the next checkpoint for that judgment.