Coldcard’s $116M exploit sparks fresh clash over NVK’s defense
Coinkite CEO NVK has reignited debate over Coldcard’s $116 million seed-generation exploit by defending its security reviews and arguing that a new AI model found a defect human reviewers missed.
- NVK says at least 15 external reviews or research efforts touched Coldcard before the defect emerged.
- Luke Dashjr disputes claims that human reviewers could not identify problems with the random-number generator.
- James O’Beirne says he raised concerns about Coldcard’s randomness implementation in May 2025.
- Coinkite’s current security record says a separate detailed technical postmortem remains in preparation.
NVK, posting on X on Nov. 9, said the work included reviews of Coldcard hardware, firmware, tools connected to random-number generation, and release controls. He cited two paid third-party product reviews: one covering Mk4 in 2022 and another covering Q in 2024.
He said Rob Ham’s OpenAI Cybersecurity Harness review produced 85 candidate findings before the incident. Several prompted fixes, according to NVK, but the seed-generation defect was absent.
“The uncomfortable truth is that it took a new AI model to find what humans couldn’t,” he wrote.
Coldcard reviewers dispute NVK’s defense
Bitcoin developer Luke Dashjr challenged the suggestion that human review could not uncover the problem, saying he had privately shared findings with Coinkite and was now disclosing them publicly.
Dashjr cautioned that he was not claiming every issue was definitely a bug or could be exploited. He described his examination as a quick look, without a full audit or extensive time reviewing the code.
His objection focused on NVK’s claim about AI: Dashjr said the assertion that only a sophisticated model could identify problems with the random-number generator was false.
Other participants questioned how Coinkite handled scrutiny. Alex Waltz accused the company and NVK of discouraging people from examining the code. Kenneth argued that ongoing quality assurance differs from asking a team to review an entire codebase.
Shinobi defended NVK, arguing that reviewers had examined the entropy system without identifying the defect. He challenged critics to produce a reproducible failure, saying a private message expressing concern was not equivalent to a security disclosure.
Earlier warnings remain a point of contention
James O’Beirne’s older posts resurfaced in the exchange. Writing on Aug. 4, he said he began examining Coldcard’s firmware in May 2025 to establish where its random-number generator obtained entropy.
O’Beirne said he questioned the use of the libngu library, raised concerns about hardcoded constants in its software fallback, and recommended linking directly against libsecp256k1.
According to his account, he was told the configuration was correct for physical devices and that a problem would already have become apparent. He acknowledged that he did not pursue the matter rigorously.
In an Aug. 5 follow-up, O’Beirne said he had received another credible account of a warning from 2021, separate from a Telegram discussion he had shared earlier. His suggestion that three people may have warned Coinkite remains his account of those communications.
The $116 million estimate dates to August
TRM Labs’ Aug. 5 analysis described roughly 1,816 BTC stolen from more than 5,200 addresses across four waves beginning July 30, citing Galaxy Research’s running tally.
The report traced the vulnerability to a March 2021 build configuration error that selected a weak software random-number generator. On older devices, effective seed strength fell to as little as 40 bits from an intended 128, allowing attackers to reconstruct keys without physical access.
Later fund movements were reported in September. As crypto.news previously reported, Galaxy’s Alex Thorn tracked a third-wave attacker swapping roughly 10% of that attacker’s Bitcoin through THORChain into Ether. Most of that attacker’s funds remained unmoved at the time.
An August investigation update separately described information passed to US authorities. Thorn said an attacker’s identity “may be known to law enforcement”; the report did not establish a confirmed FBI identification or recovery.
Coinkite still lists a separate postmortem as pending
Coinkite’s current security page describes its published record as a living postmortem, while saying a separate detailed technical report remains in preparation.
The page distinguishes targeted independent checks from a complete audit of every corrected firmware binary. Listed work includes hardware randomness testing, source reviews, and a reproducible build.
Current recommended standard releases are 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q. The advisory says firmware updates cannot repair existing affected seeds. Its migration instructions call for a new seed, a verified backup and receiving address, a small test transfer, and then movement of the remaining funds.
