Coldcard’s $116M exploit sparks fresh clash over NVK’s defense

Coinkite CEO NVK has reignited debate over Coldcard's $116 million seed-generation exploit by defending its security reviews and arguing that a new AI model found a defect human reviewers missed.

Summary

• NVK says at least 15 external reviews or research efforts touched Coldcard before the defect emerged.
• Luke Dashjr disputes claims that human reviewers could not identify problems with the random-number generator.
• James O'Beirne says he raised concerns about Coldcard's randomness implementation in May 2025.
• Coinkite's current security record says a separate detailed technical postmortem remains in preparation.

NVK, posting on X on Nov. 9, said the work included reviews of Coldcard hardware, firmware, tools connected to random-number generation, and release controls. He cited two paid third-party product reviews: one covering Mk4 in 2022 and another covering Q in 2024.

At least 15 documented external review or security-research efforts touched COLDCARD hardware, firmware, RNG-adjacent tools, or release controls before the defect was discovered.

A least 2 paid third-party product reviews were completed before the incident: a Mk4 review in 2022... https://t.co/xDuFqUHEpP --- NVK (@nvk) November 9, 2026

He said Rob Ham's OpenAI Cybersecurity Harness review produced 85 candidate findings before the incident. Several prompted fixes, according to NVK, but the seed-generation defect was absent.

"The uncomfortable truth is that it took a new AI model to find what humans couldn't," he wrote.

Coldcard reviewers dispute NVK's defense

Bitcoin developer Luke Dashjr challenged the suggestion that human review could not uncover the problem, saying he had privately shared findings with Coinkite and was now disclosing them publicly.

It's been long enough, and I hear nvk is going around pretending humans couldn't find the Coldcard defect.

So public disclosure time. No clue if Coinkite fixed these after I told them privately. I'm not claiming these can all be weaponised, or that they're definitely all bugs. --- Luke Dashjr (@LukeDashjr) November 9, 2026

Dashjr cautioned that he was not claiming every issue was definitely a bug or could be exploited. He described his examination as a quick look, without a full audit or extensive time reviewing the code.

His objection focused on NVK's claim about AI: Dashjr said the assertion that only a sophisticated model could identify problems with the random-number generator was false.

Other participants questioned how Coinkite handled scrutiny. Alex Waltz accused the company and NVK of discouraging people from examining the code. Kenneth argued that ongoing quality assurance differs from asking a team to review an entire codebase.

Having a team review your entire codebase is not the same thing as having QA embedded in the process. You are looking for a needle in a haystack. Having QA involved at each step makes it much easier to find a needle in a smaller subset of hay. C'mon man. --- Kenneth (@validatedcode) November 9, 2026

Shinobi defended NVK, arguing that reviewers had examined the entropy system without identifying the defect. He challenged critics to produce a reproducible failure, saying a private message expressing concern was not equivalent to a security disclosure.

Earlier warnings remain a point of contention

James O'Beirne's older posts resurfaced in the exchange. Writing on Aug. 4, he said he began examining Coldcard's firmware in May 2025 to establish where its random-number generator obtained entropy.

O'Beirne said he questioned the use of the libngu library, raised concerns about hardcoded constants in its software fallback, and recommended linking directly against libsecp256k1.

According to his account, he was told the configuration was correct for physical devices and that a problem would already have become apparent. He acknowledged that he did not pursue the matter rigorously.

In an Aug. 5 follow-up, O'Beirne said he had received another credible account of a warning from 2021, separate from a Telegram discussion he had shared earlier. His suggestion that three people may have warned Coinkite remains his account of those communications.

I got a second credible report of someone warning Coinkite about bad entropy back in 2021, 4 years before I did. Different than the Telegram guy that I QT'd earlier.

It's possible that 3 independent people warned them about this and they neglected it every time. --- James O'Beirne (@jamesob) August 5, 2026

The $116 million estimate dates to August

TRM Labs' Aug. 5 analysis described roughly 1,816 BTC stolen from more than 5,200 addresses across four waves beginning July 30, citing Galaxy Research's running tally.

The report traced the vulnerability to a March 2021 build configuration error that selected a weak software random-number generator. On older devices, effective seed strength fell to as little as 40 bits from an intended 128, allowing attackers to reconstruct keys without physical access.

Later fund movements were reported in September. As crypto.news previously reported, Galaxy's Alex Thorn tracked a third-wave attacker swapping roughly 10% of that attacker's Bitcoin through THORChain into Ether. Most of that attacker's funds remained unmoved at the time.

An August investigation update separately described information passed to US authorities. Thorn said an attacker's identity "may be known to law enforcement"; the report did not establish a confirmed FBI identification or recovery.

Coinkite still lists a separate postmortem as pending

Coinkite's current security page describes its published record as a living postmortem, while saying a separate detailed technical report remains in preparation.

The page distinguishes targeted independent checks from a complete audit of every corrected firmware binary. Listed work includes hardware randomness testing, source reviews, and a reproducible build.

Current recommended standard releases are 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q. The advisory says firmware updates cannot repair existing affected seeds. Its migration instructions call for a new seed, a verified backup and receiving address, a small test transfer, and then movement of the remaining funds.