Coldcard exploit debate turns on what reviewers knew

In a post on X on Nov. 9, NVK said reviews covered Coldcard hardware, firmware, tools linked to random-number generation and release controls. He cited paid third-party product reviews of the Mk4 in 2022 and the Q in 2024. A review by Rob Ham’s OpenAI Cybersecurity Harness produced 85 candidate findings before the incident; NVK said several led to fixes, but none identified the seed-generation defect. “The uncomfortable truth is that it took a new AI model to find what humans couldn’t,” he wrote.

Bitcoin developer Luke Dashjr disputed that claim, saying he had privately shared findings with Coinkite and was now making them public. He cautioned that he had conducted only a quick examination, not a full audit, and was not claiming every issue was a definite bug or exploitable. His objection centered on NVK’s suggestion that human reviewers could not identify problems with the random-number generator. Other participants questioned Coinkite’s approach to scrutiny, while Shinobi defended NVK and called on critics to provide a reproducible failure.

James O’Beirne said he began examining Coldcard firmware in May 2025 to trace the source of its random-number-generator entropy. He said he questioned the use of the libngu library, raised concerns about hardcoded constants in its software fallback and recommended linking directly against libsecp256k1. According to O’Beirne, he was told the configuration was correct for physical devices and that a problem would already have surfaced; he acknowledged he did not pursue the issue rigorously. He later said he had heard of a separate warning from 2021 and suggested three people may have raised concerns, a claim based on his account of those communications.

TRM Labs’ Aug. 5 analysis put the theft at roughly 1,816 BTC from more than 5,200 addresses across four waves starting July 30, citing Galaxy Research’s running tally. It traced the flaw to a March 2021 build configuration error that selected a weak software random-number generator. On older devices, effective seed strength fell to as little as 40 bits, rather than the intended 128, allowing attackers to reconstruct keys without physical access.

Coinkite’s security page describes its published record as a living postmortem and says a separate detailed technical report is still in preparation. It lists recommended standard releases as 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q. The company’s advisory says firmware updates cannot repair affected seeds; its migration instructions call for creating a new seed, verifying a backup and receiving address, making a small test transfer, then moving the remaining funds.