Fifteen security reviews, and not one alarm. Three months after the siphoning of around 1,800 BTC from Coldcard wallets, the boss of Coinkite reopens the case on X to defend its past audits and designate artificial intelligence as the only one capable of having spotted the flaw. Several Bitcoin developers replied that they had warned.
If you created your seed on a Coldcard before summer, this quarrel doesn't change anything for you. You must always migrate to a new recovery phrase.
Key points:
On November 9, NVK identified at least fifteen external examinations that missed the defect.
According to him, only a recent AI model could flush out this bug slipped into the code in March 2021.
Luke Dashjr says he privately sent Coinkite nine comments about the random generator.
Coinkite acknowledges that no full independent audit of patched firmware exists to date.
A device update does not save an old seed.
Coldcard: NVK’s defense holds up in fifteen audits
On November 9, Rodolfo Novak, aka NVK, published a long thread on The lot includes two paid reviews, that of the Mk4 in 2022 and that of the Q in 2024.
He also cites a screening carried out by developer Rob Ham with the OpenAI cybersecurity tool. Result, 85 potential problems reported and several corrections, but no trace of the seed generation fault. “The inconvenient truth is that it took a new AI model to find what humans couldn’t find,” writes NVK.
The bug dates from March 2021. To create a seed (the sequence of 12 or 24 words which allows all the keys of a wallet to be reconstituted), the firmware called the MicroPython software generator instead of the intended hardware chance chip. Keys that were supposed to be impossible to find became guessable by brute force. On July 30, an initial sweep cleared 1,196 addresses in 41 minutes.
Coldcard rift: Luke Dashjr and James O’Beirne say they warned
The response came the same day. Bitcoin Core developer Luke Dashjr has published nine observations about Coldcard's random generator, which he claims he first communicated privately to Coinkite. It targets generator initialization, STM32 chip error handling and repeated value detection. He specifies that he only took a quick look and does not claim that each point can be exploited. On AI, on the other hand, he does not take gloves: presenting these flaws as findable by a brilliant AI and by it alone is for him a pure and simple lie.
James O'Beirne had already said at the beginning of August that he had started peeling the firmware in May 2025. He was wondering about the libngu library and hard-coded constants in the emergency software generator. He would have been told that the configuration was correct on the physical devices. He admits he didn't insist.
The tone rises quickly. Alex Waltz accuses Coinkite of having discouraged the examination of his code, when Shinobi defends NVK by recalling that reviewers had indeed inspected the entropy system without seeing anything. And NVK, for its part, repeats that a private message expressing concern does not amount to a disclosure of a reproducible flaw.
Wallet Coldcard: a postmortem still in preparation
Both camps stumble upon the same blind spot. As of August 3, Nick Percoco, Kraken's security manager, explained that auditors checked the presence of the correct generator in the code, without checking that the production firmware called it. At the end of August, Trezor added that a paid audit from March 2022, which precisely covered random generation, had been missed.
On the Coinkite side, the security status page updated on October 1 lists four independent checks targeted on the corrected firmware. She clarifies that there is no complete independent audit of each binary. The detailed technical postmortem, awaited since the summer? Still “in preparation”.
For you, the instructions have not changed one iota. The recommended versions are 5.6.3 for Mk4 and Mk5 and 1.5.3Q for Q, but an update does not migrate a seed. The only recognized exception is that a seed created with at least 50 fair die rolls and never exposed provides approximately 128 bits of entropy. For all others, new recovery phrase on an up-to-date device, then transfer of funds.
