TL;DR:
The Coldcard exploit accumulated estimated losses of approximately $116 million, affecting over 5,200 Bitcoin addresses between July and August 2026.
Rodolfo Novak (NVK), CEO of Coinkite, defended prior security reviews and argued that a new artificial intelligence model managed to detect a flaw that human reviewers missed.
Security developers and researchers such as Luke Dashjr and James O’Beirne disputed NVK’s claims, pointing out that warnings regarding the random number generator had been communicated beforehand.
The debate over the robustness of open-source audits in cryptocurrency custody intensified following statements by Rodolfo Novak (NVK), CEO of Coinkite , regarding the $116 million exploit that affected Coldcard hardware wallets. The incident, originally recorded between July 30 and August 4, 2026, drained nearly 1,816 BTC from more than 5,200 addresses due to an entropy generation flaw introduced in firmware versions 4.0.1 and later.
At least 15 documented external review or security-research efforts touched COLDCARD hardware, firmware, RNG-adjacent tools, or release controls before the defect was discovered.
A least 2 paid third-party product reviews were completed before the incident: a Mk4 review in 2022… https://t.co/xDuFqUHEpP
— NVK (@nvk) November 9, 2026
According to NVK’s report published via his X account, at least two paid third-party product reviews were completed prior to the incident, including a 2022 Mk4 model audit and additional automated reviews. Novak indicated that the security assessment performed using OpenAI’s tool produced dozens of finding candidates that prompted prior corrections, but maintained that the seed generation defect was absent from those analyses. “The uncomfortable truth is that it took a new artificial intelligence model to find what humans couldn’t,” the executive stated.
Community Discrepancies and Prior Alerts
Coinkite management’s statements drew an immediate response from independent researchers and Bitcoin ecosystem developers. Developer Luke Dashjr publicly questioned NVK’s arguments, noting that competent human reviews were capable of identifying anomalies in the random number system if specific logical aspects of the code had been examined.
Meanwhile, researcher James O’Beirne stated that he had privately raised concerns regarding the implementation of randomness in Coldcard as early as May 2025, adding to other independent reports issued in previous years. In contrast, analysts like Shinobi came to the defense of Coinkite’s reviews, arguing that external audit teams examined the entropy system without isolating the exact flaw at the time, and qualified that a preliminary warning does not constitute a formal vulnerability disclosure.
Implications for Self-Custody Infrastructure
The incident occurring in the second half of 2026 exposed the risks associated with silent logical errors in cold storage devices. Unlike phishing attacks or the compromise of external servers, the vulnerability stemmed from a build configuration that omitted the call to the hardware generator in favor of a software-based process.
Facing this scenario, recovery guides issued by blockchain analytics firms such as TRM Labs a nd Galaxy Research emphasized that a firmware update corrects the behavior in future devices, but does not restore the security of seed phrases generated under the affected code. Impacted users remain under the operational recommendation to migrate their funds to new recovery phrases generated with independent entropy, such as the use of physical dice, to mitigate remaining risks at the exposed addresses.
