{"id":25127,"date":"2026-11-09T22:42:02","date_gmt":"2026-11-09T22:42:02","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/11\/09\/coldcards-116m-exploit-renews-dispute-over-security-reviews\/"},"modified":"2026-11-09T22:42:02","modified_gmt":"2026-11-09T22:42:02","slug":"coldcards-116m-exploit-renews-dispute-over-security-reviews","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/11\/09\/coldcards-116m-exploit-renews-dispute-over-security-reviews\/","title":{"rendered":"Coldcard\u2019s $116M exploit renews dispute over security reviews"},"content":{"rendered":"<p> <br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/media.crypto.news\/2025\/06\/crypto-news-Hackers-keep-exploiting-audited-DeFi-protocols-option01.webp\" \/><\/p>\n<div>\n<p class=\"is-style-lead\">Coinkite CEO NVK has reignited debate over Coldcard\u2019s $116 million seed-generation exploit by defending its security reviews and arguing that a new AI model found a defect human reviewers missed.<\/p>\n<div id=\"cn-block-summary-block_330e7c0192fcaf98ddde12d55632fa90\" class=\"cn-block-summary\">\n<p>\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/p>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>NVK says at least 15 external reviews or research efforts touched Coldcard before the defect emerged.<\/li>\n<li>Luke Dashjr disputes claims that human reviewers could not identify problems with the random-number generator.<\/li>\n<li>James O\u2019Beirne says he raised concerns about Coldcard\u2019s randomness implementation in May 2025.<\/li>\n<li>Coinkite\u2019s current security record says a separate detailed technical postmortem remains in preparation.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>NVK, posting on X on Nov. 9, said the work included reviews of Coldcard hardware, firmware, tools connected to random-number generation, and release controls. He cited two paid third-party product reviews: one covering Mk4 in 2022 and another covering Q in 2024.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">At least 15 documented external review or security-research efforts touched COLDCARD hardware, firmware, RNG-adjacent tools, or release controls before the defect was discovered.<\/p>\n<p>A least 2 paid third-party product reviews were completed before the incident: a Mk4 review in 2022\u2026 <a href=\"https:\/\/t.co\/xDuFqUHEpP\">https:\/\/t.co\/xDuFqUHEpP<\/a><\/p>\n<p>\u2014 NVK (@nvk) <a href=\"https:\/\/x.com\/nvk\/status\/2119819982770954324?ref_src=twsrc%5Etfw\">November 9, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>He said Rob Ham\u2019s OpenAI Cybersecurity Harness review produced 85 candidate findings before the incident. Several prompted fixes, according to NVK, but the seed-generation defect was absent.<\/p>\n<p>\u201cThe uncomfortable truth is that it took a new AI model to find what humans couldn\u2019t,\u201d he wrote.<\/p>\n<h2 class=\"wp-block-heading\">Coldcard reviewers dispute NVK\u2019s defense<\/h2>\n<p>Bitcoin developer Luke Dashjr challenged the suggestion that human review could not uncover the problem, saying he had privately shared findings with Coinkite and was now disclosing them publicly.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">It&#8217;s been long enough, and I hear nvk is going around pretending humans couldn&#8217;t find the Coldcard defect.<\/p>\n<p>So public disclosure time. No clue if Coinkite fixed these after I told them privately. I&#8217;m not claiming these can all be weaponised, or that they&#8217;re definitely all bugs.<\/p>\n<p>\u2014 Luke Dashjr (@LukeDashjr) <a href=\"https:\/\/x.com\/LukeDashjr\/status\/2119836060306018364?ref_src=twsrc%5Etfw\">November 9, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Dashjr cautioned that he was not claiming every issue was definitely a bug or could be exploited. He described his examination as a quick look, without a full audit or extensive time reviewing the code.<\/p>\n<p>His objection focused on NVK\u2019s claim about AI: Dashjr said the assertion that only a sophisticated model could identify problems with the random-number generator was false.<\/p>\n<p>Other participants questioned how Coinkite handled scrutiny. Alex Waltz <a href=\"https:\/\/x.com\/raw_avocado\/status\/2119823339472695455\" target=\"_blank\">accused<\/a> the company and NVK of discouraging people from examining the code. Kenneth argued that ongoing quality assurance differs from asking a team to review an entire codebase.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Having a team review your entire codebase is not the same thing as having QA embedded in the process. You are looking for a needle in a haystack. Having QA involved at each step makes it much easier to find a needle in a smaller subset of hay. C\u2019mon man.<\/p>\n<p>\u2014 Kenneth (@validatedcode) <a href=\"https:\/\/x.com\/validatedcode\/status\/2119824178274808273?ref_src=twsrc%5Etfw\">November 9, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Shinobi defended NVK, arguing that reviewers had examined the entropy system without identifying the defect. He challenged critics to produce a reproducible failure, saying a private message expressing concern was not equivalent to a security disclosure.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\">Earlier warnings remain a point of contention<\/h2>\n<p>James O\u2019Beirne\u2019s older posts resurfaced in the exchange. Writing on Aug. 4, he said he began examining Coldcard\u2019s firmware in May 2025 to establish where its random-number generator obtained entropy.<\/p>\n<p>O\u2019Beirne said he questioned the use of the libngu library, raised concerns about hardcoded constants in its software fallback, and recommended linking directly against libsecp256k1.<\/p>\n<p>According to his account, he was told the configuration was correct for physical devices and that a problem would already have become apparent. He acknowledged that he did not pursue the matter rigorously.<\/p>\n<p>In an Aug. 5 follow-up, O\u2019Beirne said he had received another credible account of a warning from 2021, separate from a Telegram discussion he had shared earlier. His suggestion that three people may have warned Coinkite remains his account of those communications.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">I got a second credible report of someone warning Coinkite about bad entropy back in 2021, 4 years before I did. Different than the Telegram guy that I QT&#8217;d earlier.<\/p>\n<p>It&#8217;s possible that 3 independent people warned them about this and they neglected it every time.<\/p>\n<p>\u2014 James O&#8217;Beirne (@jamesob) <a href=\"https:\/\/x.com\/jamesob\/status\/2085001896192827884?ref_src=twsrc%5Etfw\">August 5, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<h2 class=\"wp-block-heading\">The $116 million estimate dates to August<\/h2>\n<p>TRM Labs\u2019 Aug. 5 <a href=\"https:\/\/www.trmlabs.com\/resources\/blog\/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack\" target=\"_blank\">analysis<\/a> described roughly 1,816 BTC stolen from more than 5,200 addresses across four waves beginning July 30, citing Galaxy Research\u2019s running tally.<\/p>\n<p>The report traced the vulnerability to a March 2021 build configuration error that selected a weak software random-number generator. On older devices, effective seed strength fell to as little as 40 bits from an intended 128, allowing attackers to reconstruct keys without physical access.<\/p>\n<p>Later fund movements were reported in September. As crypto.news previously reported, Galaxy\u2019s Alex Thorn tracked a third-wave attacker <a href=\"https:\/\/crypto.news\/coldcard-hacker-uses-thorchain-to-swap-stolen-btc\/\" target=\"_blank\">swapping roughly 10%<\/a> of that attacker\u2019s Bitcoin through THORChain into Ether. Most of that attacker\u2019s funds remained unmoved at the time.<\/p>\n<p>An August investigation update separately described <a href=\"https:\/\/crypto.news\/coldcard-theft-fbi-may-know-1082-btc-attacker\/\" target=\"_blank\">information passed to US authorities<\/a>. Thorn said an attacker\u2019s identity \u201cmay be known to law enforcement\u201d; the report did not establish a confirmed FBI identification or recovery.<\/p>\n<h2 class=\"wp-block-heading\">Coinkite still lists a separate postmortem as pending<\/h2>\n<p>Coinkite\u2019s current <a href=\"https:\/\/coldcard.com\/security\/status\" target=\"_blank\">security page<\/a> describes its published record as a living postmortem, while saying a separate detailed technical report remains in preparation.<\/p>\n<p>The page distinguishes targeted independent checks from a complete audit of every corrected firmware binary. Listed work includes hardware randomness testing, source reviews, and a reproducible build.<\/p>\n<p>Current recommended standard releases are 5.6.3 for Mk4\/Mk5 and 1.5.3Q for Q. The <a href=\"https:\/\/blog.coinkite.com\/coldcard-mk3-seed-generation-warning\/\" target=\"_blank\">advisory<\/a> says firmware updates cannot repair existing affected seeds. Its migration instructions call for a new seed, a verified backup and receiving address, a small test transfer, and then movement of the remaining funds.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><br \/>\n<br \/><a href=\"https:\/\/crypto.news\/coldcard-116m-exploit-nvk-security-review-dispute\/\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coinkite CEO NVK has reignited debate over Coldcard\u2019s $116 million seed-generation exploit by defending its security reviews and arguing that a new AI model found a defect human reviewers missed. Summary NVK says at least 15 external reviews or research efforts touched Coldcard before the defect emerged. Luke Dashjr disputes claims that human reviewers could [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":24945,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[23],"tags":[],"kronos_expire_date":[],"class_list":["post-25127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"_links":{"self":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/25127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/comments?post=25127"}],"version-history":[{"count":0,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/25127\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media\/24945"}],"wp:attachment":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media?parent=25127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/categories?post=25127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/tags?post=25127"},{"taxonomy":"kronos_expire_date","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/kronos_expire_date?post=25127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}