Hacking News
Coldcard Security Debate Grows After $116M BTC Wallet Hack
Coinkite CEO NVK defended Coldcard's security checks on November 9, claiming a new AI model found the flaw behind an estimated $116 million Bitcoin theft. Developer Luke Dashjr disputed the claim, stating that human reviewers could not detect the flaw. NVK mentioned that Coldcard underwent at least two paid third-party reviews, one of which examined the Mk4 in 2022 and another the Q in 2024. Rob Ham conducted a separate review using the OpenAI Cybersecurity Harness, identifying 85 potential issues and prompting several fixes. However, the review failed to detect the seed defect. James O’Beirne began reviewing Coldcard firmware in May 2025, flagging fixed starting values to Coinkite, which were in libngu, a software library that helped generate wallet seeds. The thefts affected more than 5,200 addresses in four waves starting July 30, with seed strength on older devices falling from 128 bits to as little as 40, allowing attackers to rebuild wallet keys without physical access. Coinkite is preparing a detailed technical report and advises affected users to move funds to a wallet with a new seed.