Coinkite CEO NVK defended Coldcard’s security checks on November 9. He said a new AI model found the flaw behind an estimated $116 million Bitcoin theft. Developer Luke Dashjr disputed the claim about what human reviewers could detect.
On X, NVK said Coldcard underwent at least two paid third-party reviews before the exploit. One covered the Mk4 in 2022, and another examined the Q in 2024.
NVK said Rob Ham conducted a separate review using the OpenAI Cybersecurity Harness. The review identified 85 potential issues and prompted several fixes. However, it failed to detect the seed defect.
What Developers Flagged in Coldcard Code
Dashjr said he took a brief look at the code. He shared his findings privately with Coinkite before making them public. His criticism focused on the random-number generator.
In an August 4 post, James O’Beirne said he began reviewing Coldcard firmware in May 2025. He said he flagged fixed starting values to Coinkite. Those values were in libngu, a software library that helped generate wallet seeds.
How a Build Error Weakened Coldcard Seeds
However, TRM Labs put losses at about 1,816 BTC, citing Galaxy Research. The thefts affected more than 5,200 addresses in four waves starting July 30.
The firm traced the flaw to a March 2021 build error. Seed strength on older devices fell from an intended 128 bits to as little as 40. That let attackers rebuild wallet keys without physical access.
Coinkite highlighted that it is preparing a detailed technical report. Its advisory warns that firmware updates leave weak seeds vulnerable. The company directs affected users to move funds to a wallet with a new seed.
Related: CZ Dismisses Binance 335M-Record Data Breach Claim as a $900K Scam
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
