Debate Rages Over Coldcard Security After $116 Million Seed Exploit Revealed

Introduction

The security of Coinkite's Coldcard Bitcoin hardware wallets has come under intense scrutiny following a $116 million exploitation linked to flaws in their seed generation process. NVK, the CEO of Coinkite, recently took to social media platform X on November 9 to address this situation, underlining the comprehensive security reviews undertaken on Coldcard products, which scrutinized hardware, firmware, and random-number generation tools.

Security Reviews and Criticism

Despite the extensive reviews—at least 15 documented external assessments were involved—the detection of a critical defect has sparked heated debate within the cryptocurrency community. NVK highlighted two paid assessments to bolster his position: one was conducted for the Mk4 model in 2022, and another for the Q in 2024. Interestingly, NVK referenced findings from an OpenAI Cybersecurity Harness review led by Rob Ham, which identified 85 potential issues with the Coldcard before the exploit became known. According to NVK, while some of these findings prompted corrective actions, the pivotal seed-generation flaw remained undiscovered.

"The uncomfortable truth is that it took a new AI model to find what humans couldn’t," NVK asserted, igniting further discussions about the efficacy of human reviewers.

Bitcoin developer Luke Dashjr contested NVK's suggestion that human scrutiny was insufficient, claiming he had shared concerns regarding the Coldcard vulnerabilities directly with Coinkite in private and felt the need to now disclose them publicly. Dashjr remarked,

"No clue if Coinkite fixed these after I told them privately,"

further emphasizing that his informal review lacked the depth of a formal audit, yet he felt compelled to speak out.

Community Reactions

In the wake of NVK’s defense, critics such as Alex Waltz and Kenneth weighed in, suggesting that Coinkite’s leadership seemed to be discouraging scrutiny of their codebase. Waltz criticized the reliance on comprehensive audits rather than integrating quality assurance into the development process, stating that examining the entire codebase is inherently flawed without continuous QA involvement.

On the other side, fellow reviewer Shinobi defended NVK, asserting that the entropy system had indeed undergone scrutiny without the defect being detected prior to the AI model's revelation. Shinobi challenged critics to document reproducible failures to substantiate their claims against Coinkite.

Historical Concerns and Analysis

Compounding the discussion, James O’Beirne, who began reviewing Coldcard’s firmware back in May 2025, recalled his concerns regarding the system's random-number generator and previously flagged issues with hardcoded constants. He claimed multiple individuals had alerted Coinkite about potential entropy problems, warning them as far back as 2021, although he himself did not rigorously pursue these issues.

An analysis by TRM Labs released on August 5 revealed that approximately 1,816 BTC had been stolen from over 5,200 wallets, tracing the vulnerability back to a faulty build configuration from March 2021 that lowered the random-number generator's effectiveness drastically. The implications of this breach were compounded by subsequent fund movements tracked by Galaxy's Alex Thorn in September, indicating ongoing complexities regarding the stolen assets.

Coinkite's Response

Coinkite has characterized its security page as a continuously updated postmortem on the incident, indicating that a detailed technical report is forthcoming. Meanwhile, it has specified their current recommended firmware versions, advising that existing affected seeds cannot be repaired and outlining necessary migration steps for users to secure their funds. This ongoing saga underscores the vital intersection between security practices and user confidence in the cryptocurrency realm, as companies like Coinkite navigate the fallout from this significant breach.