{"investigation":{"slug":"coldcard-coinkite-firmware-seed-entropy-exploit-multi-actor-august-2026","entity_name":"Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)","trust_score":0,"severity_base":null,"score_modifier":-5.88,"confidence":0.91,"status":"published","content_type":"investigation","summary":"Starting around July 30, 2026, multiple unrelated attackers began draining Bitcoin from wallets whose seed phrases had been generated on Coinkite's Coldcard hardware wallet using firmware with a weak random-number generator, a defect that traced back to a build/link error introduced in March 2021. Galaxy Research tracked at least four waves of theft reaching roughly 1,789 BTC (about $112-115 million at the time of theft) from thousands of addresses as of late August 2026, with some outlets citing cumulative figures above $140 million by October 2026. Coinkite shipped emergency firmware within 24-48 hours but could not retroactively secure already-compromised seeds, triggering public apologies from CEO Rodolfo Novak, a proposed class action in Ontario, and allegations — disputed and not independently confirmed — that a senior Coinkite employee had been warned of the flaw more than a year before the attacks.","sections":[{"content":"Coinkite's own technical disclosure states that during a March 2021 migration of its firmware's randomness library (libNgU), a macro guard intended to force a compile-time error if hardware random-number generation was disabled instead failed silently, because the preprocessor directive tested whether the macro was defined rather than whether its value was nonzero. As a result, seed generation on affected firmware called into MicroPython's built-in software pseudo-random number generator (Yasmarang) rather than the device's hardware true-random-number generator (TRNG). Coinkite says the device's secure elements and hardware TRNG were not themselves breached or remotely compromised; rather, attackers were able to reconstruct the weakened keyspace offline, without needing physical or remote access to any device. Coinkite's estimate of the resulting effective entropy is roughly 40 bits for Mk2/Mk3 devices and roughly 72 bits for Mk4, Mk5 and Coldcard Q devices (mixed with secure-element TRNG output), against an intended target of 128 bits — a reduction researchers and Coinkite alike describe as brute-forceable with modern computing resources.","heading":"The Vulnerability: A 2021 Build Error, Not a Design Choice","sources":[{"url":"https://blog.coinkite.com/entropy-technical-backgrounder/","name":"Coinkite entropy technical backgrounder","type":"official","credibility":1},{"url":"https://decrypt.co/374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits","name":"Decrypt — Coldcard Bitcoin exploit explained: entropy, keys, bits","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","name":"TRM Labs — The Largest Hardware Wallet Exploit of 2026","type":"research","credibility":2}],"severity":"critical"},{"content":"Per Coinkite's own advisory, seeds generated on Mk2/Mk3 firmware 4.0.1 through 4.1.9 (fixed in 4.2.0), and on Mk4/Mk5 firmware before 5.6.0 (Standard) or 6.6.0X (Edge), and Coldcard Q firmware before 1.5.0Q (Standard) or 6.6.0QX (Edge), are affected. TAPSIGNER, OPENDIME and SATSCARD, which run different codebases, were not affected. Firmware was vulnerable for roughly four years, from the March 2021 release through the July 2026 patch. Critically, the firmware update itself does not repair seeds already generated on vulnerable firmware; Coinkite has said funds on such seeds remain at risk unless protected by a strong, unique BIP-39 passphrase, and advises affected users to generate an entirely new seed on patched firmware and migrate funds.","heading":"Affected Firmware and Devices","sources":[{"url":"https://blog.coinkite.com/entropy-technical-backgrounder/","name":"Coinkite entropy technical backgrounder","type":"official","credibility":1},{"url":"https://www.archerlaw.com/print/v2/content/11711/coldcard-security-flaw-raises-risks-for-certain-bitcoin-wallets.pdf","name":"Archer Law — Coldcard security flaw raises risks for certain bitcoin wallets","type":"other","credibility":2}],"severity":"critical"},{"content":"Galaxy Research, which tracked the thefts on-chain, reported that a first wave on July 30, 2026 drained roughly 1,082.65 BTC (about $70 million) from approximately 1,196 addresses in a roughly 41-minute window, using transactions with a shared on-chain fingerprint (identical fees, no change outputs). Subsequent waves broadened the victim set: by August 2, reported cumulative losses reached roughly 1,367 BTC (about $88-89 million) across 4,585 addresses; by August 4, Cointelegraph reported Galaxy's confirmed count at 1,596 BTC (over $100 million) across roughly 7,300 addresses, with 73 victims having contacted Galaxy's researchers directly, and a suspected fourth wave (medium-high confidence) that could add a further several hundred BTC. By August 25, Galaxy's tally stood at roughly 1,789 BTC (about $112-115 million) across approximately 8,865 addresses, with about 87% of the stolen funds still unmoved in attacker-controlled wallets. Galaxy said no new confirmed attacker activity had appeared after August 6, 2026. Some later secondary reports cite cumulative figures above $140 million by autumn 2026, though these have not been matched to a single authoritative Galaxy update in the sources reviewed, and should be treated as provisional.","heading":"Attack Waves, Scale and Timing","sources":[{"url":"https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves","name":"Cointelegraph — Coldcard Bitcoin theft tops $100M across 3 confirmed attack waves: Galaxy","type":"news_article","credibility":2},{"url":"https://decrypt.co/375656/coldcard-bitcoin-thefts-slow-losses-top-150-million","name":"Decrypt — Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy","type":"news_article","credibility":2},{"url":"https://beincrypto.com/coldcard-fourth-attack-wave-bitcoin/","name":"BeInCrypto — Coldcard Bitcoin Exploit Enters Fourth Wave With 462 New Suspected Victims","type":"news_article","credibility":2},{"url":"https://guelph.ctvnews.ca/business/article/hackers-drain-more-than-140m-in-bitcoin-from-devices-made-by-canadian-firm/","name":"CTV News — Hackers drain more than $140M in bitcoin from devices made by Canadian firm","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Galaxy Research's head of research, Alex Thorn, stated that the sweeps appeared programmatic and were likely orchestrated with the assistance of a large language model, and separately that Galaxy had identified footprints consistent with at least 15 distinct attackers, with evidence of dozens of additional smaller, possibly opportunistic actors exploiting the same public vulnerability independently rather than a single coordinated campaign. Coinkite stated it had to assume an attacker used AI to scan its open-source firmware for the defect, and said its own recent AI-assisted code review had not flagged the bug. Dragonfly's Haseeb Qureshi was separately quoted suggesting modest AI-assisted code review could plausibly have caught the flaw earlier. These attribution and tooling claims rest on on-chain pattern analysis and public statements by Galaxy and Coinkite rather than a forensic confirmation of attacker tooling, and should be read as the firms' informed assessments rather than established fact.","heading":"Multiple, Possibly AI-Assisted Attackers","sources":[{"url":"https://cointelegraph.com/news/15-attackers-exploited-coldcard-vulnerability-galaxy","name":"Cointelegraph — At least 15 attackers exploited Coldcard vulnerability: Galaxy","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/15/coldcard-attackers-likely-used-unrestricted-ai-models-galaxy-says/","name":"CryptoTimes — Coldcard attackers likely used unrestricted AI models, Galaxy says","type":"news_article","credibility":2}],"severity":"high"},{"content":"Coinkite published a technical disclosure and migration guidance; the firm's own page is dated and text-updated August 1, 2026 (2:35 p.m. EDT), though the page does not give a specific time for the initial emergency firmware's release, only the date. Secondary reporting places the emergency firmware (4.2.0 for Mk2/Mk3, with corresponding fixed builds for Mk4/Mk5/Q) on or around July 31, 2026; no source reviewed, including Coinkite's own disclosure, supports a specific time-of-day for that release, so no time is asserted here. Coinkite CEO Rodolfo Novak publicly apologized on X, stating \"I'm sorry and I'm devastated,\" and the company said it takes full responsibility for the vulnerability and that its internal review processes had failed to catch it. Coinkite halted shipments of affected inventory and reported destroying unsold vulnerable stock. Later firmware for Mk4/Mk5/Q (reported as 5.6.1 and 1.5.1Q) added a requirement for user-supplied entropy, such as dice rolls, during seed generation as an additional safeguard.","heading":"Coinkite's Response and Remediation","sources":[{"url":"https://blog.coinkite.com/entropy-technical-backgrounder/","name":"Coinkite entropy technical backgrounder","type":"official","credibility":1},{"url":"https://ia.acs.org.au/article/2026/bitcoin-wallet-bug-sparks--144m-crypto-heist.html","name":"Information Age / ACS — Bitcoin wallet bug sparks $144m crypto heist","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/coldcard-upgrade-strengthen-seed-phrase-generation","name":"CoinTelegraph — Coldcard strengthens seed generation with firmware update","type":"news_article","credibility":2}],"severity":"high"},{"content":"Bitcoin developer James O'Beirne published an analysis on August 4, 2026 alleging that he had audited Coldcard's firmware in May 2025, identified the low-maintenance libNgU dependency as a potential source of weak randomness, and warned Coinkite of the possible defect, receiving a response to the effect that if something were wrong, the company would already know about it. In the same analysis, O'Beirne alleged — based on matching GPG commit-signature keys — that the pseudonymous GitHub account that had authored the vulnerable code ('Switck'/'Switch') was the same person as Coinkite co-founder and CTO Peter D. Gray, who commits under the name 'Peter D. Gray' in the same repository. As of the sources reviewed, Coinkite had not issued a public response specifically addressing the identity claim or the alleged 2025 warning. This allegation rests on one researcher's analysis rather than an independent audit, forensic confirmation, or any admission from Coinkite or Gray, and is presented here as an unverified, alleged claim.","heading":"Allegation: Prior Warning to Coinkite's CTO (Disputed, Unconfirmed)","sources":[{"url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/","name":"Cryptopolitan — Coinkite CTO Peter Gray linked to Coldcard hack","type":"news_article","credibility":2},{"url":"https://www.mitrade.com/ae-en/insights/news/live-news/article-3-1960105-20260805","name":"Mitrade — Blame lands on Coinkite CTO as BTC exploit loss nears $120M","type":"news_article","credibility":2}],"severity":"high"},{"content":"A proposed class action was filed against Coinkite Inc. and its co-founders, Rodolfo Novak and Peter D. Gray, by plaintiff Amir Reza Naderi in the Ontario Superior Court of Justice, with the claim issued September 11, 2026 under case number CV-26-00018158. The statement of claim alleges the defendants knew of weaknesses in the seed-generation system as early as May 2025 and failed to warn customers, and alleges violations of Ontario's Consumer Protection Act along with negligence and breach-of-contract theories; it seeks class certification, compensatory damages and punitive damages. Coinkite disputes that it knew of the vulnerability before July 30, 2026. Separately, Thomas Braziel of 117 Partners has said he is examining product-liability claims and a possible broader class action, and a US law firm, Stoltmann Law, has been reported — by a single secondary source — to be soliciting potential Coldcard claimants; AVOID.NET could not independently verify Stoltmann Law's specific legal theories or any verbatim public statement from the firm, and this item should be treated as low-confidence pending primary confirmation. No regulatory enforcement action by the SEC, CFTC, or other financial regulator was identified in connection with this incident in the sources reviewed; the absence of such reports is consistent with, but does not affirmatively prove, that none has occurred. As of the sources reviewed, no court has issued findings on liability in any matter arising from this incident.","heading":"Legal Exposure: Ontario Class Action and Other Threats","sources":[{"url":"https://www.cryptometer.io/news/coldcard-bitcoin-theft-sparks-lawsuit-over-allegedly-ignored-2025-security-warning/","name":"Cryptometer — Coldcard bitcoin theft sparks lawsuit over allegedly ignored 2025 security warning","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/coinkite-faces-class-action-threat-as-bitcoin-wallet-bug-costs-users-over-1300-btc/","name":"Bitcoin.com News — Coinkite faces class action threat as bitcoin wallet bug costs users over 1,300 BTC","type":"news_article","credibility":2},{"url":"https://www.bit.com/knowledge-hub/coldcard-the-security-first-wallet-that-got-hacked","name":"BIT Knowledge Hub — Coldcard: The security-first wallet that got hacked","type":"other","credibility":3}],"severity":"high"},{"content":"Bitcoin podcaster Guy Swann characterized the incident as, per Forklog's transcription, \"The worst hit in Bitcoin's history to the most savvy and 'properly secured' holders,\" underscoring that losses fell disproportionately on experienced self-custody users who had followed standard security practice (using a reputable hardware wallet) rather than on careless or inexperienced holders. Other outlets render the quote with slightly different wording (e.g., \"heaviest blow\" or \"one of the strongest blows\"), and AVOID.NET could not locate Swann's original audio to confirm a single canonical transcription; the Forklog wording is used here as the most directly sourced version. An open letter from parts of the Bitcoin development community called on Coinkite and OpenSats to address Novak's leadership, while explicitly stating it made no allegation of fraud, theft, deliberate backdooring, or prior knowledge of the defect.","heading":"Community and Expert Reaction","sources":[{"url":"https://forklog.com/en/?p=101463","name":"Forklog — Coldcard entropy flaw commentary","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Analysts and outlets covering the incident have repeatedly emphasized that the Coldcard flaw was a software/firmware defect rather than a compromise of the device's secure-element hardware or a remote-access breach, and that it affected only seeds generated while vulnerable firmware was installed, not the security model of hardware wallets generally. The episode has nonetheless been cited in the self-custody community as a reminder that open-source firmware defects can persist undetected for years (in this case roughly four years, from March 2021 to July 2026) and that users bear migration risk even when a vendor patches quickly, since existing compromised seeds cannot be retroactively secured and must be actively replaced by the user.","heading":"Broader Context: Self-Custody and Supply-Chain Risk","sources":[{"url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","name":"TRM Labs — The Largest Hardware Wallet Exploit of 2026","type":"research","credibility":2},{"url":"https://protos.com/what-to-do-if-youre-a-coldcard-victim/","name":"Protos — What to do if you're a Coldcard victim","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2021-03","event":"Coinkite ships Coldcard firmware 4.0.0/4.0.1 containing a build/link error that routes seed generation through a software pseudo-random generator instead of the hardware TRNG.","source":"Coinkite entropy technical backgrounder","source_url":"https://blog.coinkite.com/entropy-technical-backgrounder/"},{"date":"2025-05","event":"Bitcoin developer James O'Beirne says he audited Coldcard firmware, flagged the libNgU dependency as a possible source of weak randomness, and warned Coinkite; Coinkite's alleged response was that a real problem would already have surfaced.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/"},{"date":"2026-07","event":"First confirmed attack wave drains roughly 1,082.65 BTC (about $70 million) from approximately 1,196 addresses in a roughly 41-minute window.","source":"Cointelegraph / Galaxy Research","source_url":"https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves","date_original":"2026-07-30"},{"date":"2026-07","event":"Coinkite releases emergency patched firmware (4.2.0 for Mk2/Mk3 and corresponding fixed builds for other models); the fix protects only newly generated seeds.","source":"Archer Law summary of Coinkite advisory","source_url":"https://www.archerlaw.com/print/v2/content/11711/coldcard-security-flaw-raises-risks-for-certain-bitcoin-wallets.pdf","date_original":"2026-07-31"},{"date":"2026-08-01","event":"Coinkite publishes its technical backgrounder explaining the entropy defect and remediation steps.","source":"Coinkite blog","source_url":"https://blog.coinkite.com/entropy-technical-backgrounder/","date_evidence":"Updated: August 1, 2026 at 2:35 p.m. EDT"},{"date":"2026-08","event":"Cumulative confirmed losses reach roughly 1,367 BTC (about $88-89 million) across 4,585 addresses; commentators begin discussing possible class-action exposure for Coinkite.","source":"Bitcoin.com News","source_url":"https://news.bitcoin.com/coinkite-faces-class-action-threat-as-bitcoin-wallet-bug-costs-users-over-1300-btc/","date_original":"2026-08-02"},{"date":"2026-08-04","event":"Reported cumulative losses exceed $140 million (over 1,596 BTC) across roughly 7,300 addresses; Coinkite CEO Rodolfo Novak publicly apologizes, saying \"I'm sorry and I'm devastated.\"","source":"CTV News / Information Age","source_url":"https://guelph.ctvnews.ca/business/article/hackers-drain-more-than-140m-in-bitcoin-from-devices-made-by-canadian-firm/","date_evidence":"Published August 4, 2026, at 3:59 p.m. EDT, and updated the same day at 4:33 p.m. EDT"},{"date":"2026-08","event":"James O'Beirne publishes an analysis alleging Coinkite CTO Peter D. Gray authored the vulnerable code under a pseudonymous GitHub account and had dismissed his 2025 warning.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/","date_original":"2026-08-04"},{"date":"2026-08","event":"Galaxy Research says no further confirmed attacker activity has been observed after this date.","source":"Decrypt","source_url":"https://decrypt.co/375656/coldcard-bitcoin-thefts-slow-losses-top-150-million","date_original":"2026-08-06"},{"date":"2026-08","event":"Galaxy Research's updated tally reaches roughly 1,789 BTC (about $112-115 million) across approximately 8,865 addresses, with about 87% of stolen funds still unmoved.","source":"Cointelegraph / CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/24/galaxy-finds-115m-lost-in-coldcard-exploit-across-8865-addresses/","date_original":"2026-08-25"},{"date":"2026-09","event":"Plaintiff Amir Reza Naderi files a proposed class action against Coinkite Inc., Rodolfo Novak and Peter D. Gray in the Ontario Superior Court of Justice (case CV-26-00018158).","source":"Cryptometer","source_url":"https://www.cryptometer.io/news/coldcard-bitcoin-theft-sparks-lawsuit-over-allegedly-ignored-2025-security-warning/","date_original":"2026-09-11"}],"sources_used":[{"url":"https://blog.coinkite.com/entropy-technical-backgrounder/","name":"Coinkite entropy technical backgrounder","type":"official","archive_url":"http://web.archive.org/web/20261022045708/https://blog.coinkite.com/entropy-technical-backgrounder/","credibility":1,"archive_timestamp":"2026-10-22T04:57:08+00:00"},{"url":"https://guelph.ctvnews.ca/business/article/hackers-drain-more-than-140m-in-bitcoin-from-devices-made-by-canadian-firm/","name":"CTV News — Hackers drain more than $140M in bitcoin from devices made by Canadian firm","type":"news_article","archive_url":"http://web.archive.org/web/20261106100849/https://guelph.ctvnews.ca/business/article/hackers-drain-more-than-140m-in-bitcoin-from-devices-made-by-canadian-firm/","credibility":1,"archive_timestamp":"2026-11-06T10:08:49+00:00"},{"url":"https://ia.acs.org.au/article/2026/bitcoin-wallet-bug-sparks--144m-crypto-heist.html","name":"Information Age / ACS — Bitcoin wallet bug sparks $144m crypto heist","type":"news_article","archive_url":"http://web.archive.org/web/20260824115220/https://ia.acs.org.au/article/2026/bitcoin-wallet-bug-sparks--144m-crypto-heist.html","credibility":2,"archive_timestamp":"2026-08-24T11:52:20+00:00"},{"url":"https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves","name":"Cointelegraph — Coldcard Bitcoin theft tops $100M across 3 confirmed attack waves: Galaxy","type":"news_article","archive_url":"http://web.archive.org/web/20261012155032/https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves","credibility":2,"archive_timestamp":"2026-10-12T15:50:32+00:00"},{"url":"https://decrypt.co/374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits","name":"Decrypt — Coldcard Bitcoin exploit explained: entropy, keys, bits","type":"news_article","archive_url":"http://web.archive.org/web/20260913165751/https://decrypt.co/374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits","credibility":2,"archive_timestamp":"2026-09-13T16:57:51+00:00"},{"url":"https://decrypt.co/375656/coldcard-bitcoin-thefts-slow-losses-top-150-million","name":"Decrypt — Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy","type":"news_article","archive_url":"http://web.archive.org/web/20261018024803/https://decrypt.co/375656/coldcard-bitcoin-thefts-slow-losses-top-150-million","credibility":2,"archive_timestamp":"2026-10-18T02:48:03+00:00"},{"url":"https://beincrypto.com/coldcard-fourth-attack-wave-bitcoin/","name":"BeInCrypto — Coldcard Bitcoin Exploit Enters Fourth Wave With 462 New Suspected Victims","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/15-attackers-exploited-coldcard-vulnerability-galaxy","name":"Cointelegraph — At least 15 attackers exploited Coldcard vulnerability: Galaxy","type":"news_article","archive_url":"http://web.archive.org/web/20261018072236/https://cointelegraph.com/news/15-attackers-exploited-coldcard-vulnerability-galaxy","credibility":2,"archive_timestamp":"2026-10-18T07:22:36+00:00"},{"url":"https://www.cryptotimes.io/2026/08/15/coldcard-attackers-likely-used-unrestricted-ai-models-galaxy-says/","name":"CryptoTimes — Coldcard attackers likely used unrestricted AI models, Galaxy says","type":"news_article","archive_url":"http://web.archive.org/web/20261017104112/https://www.cryptotimes.io/2026/08/15/coldcard-attackers-likely-used-unrestricted-ai-models-galaxy-says/","credibility":2,"archive_timestamp":"2026-10-17T10:41:12+00:00"},{"url":"https://www.cryptotimes.io/2026/08/24/galaxy-finds-115m-lost-in-coldcard-exploit-across-8865-addresses/","name":"CryptoTimes — Galaxy finds $115M lost in Coldcard exploit across 8,865 addresses","type":"news_article","archive_url":"http://web.archive.org/web/20261017104208/https://www.cryptotimes.io/2026/08/24/galaxy-finds-115m-lost-in-coldcard-exploit-across-8865-addresses/","credibility":2,"archive_timestamp":"2026-10-17T10:42:08+00:00"},{"url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/","name":"Cryptopolitan — Coinkite CTO Peter Gray linked to Coldcard hack","type":"news_article","archive_url":"http://web.archive.org/web/20261016074100/https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/","credibility":2,"archive_timestamp":"2026-10-16T07:41:00+00:00"},{"url":"https://www.mitrade.com/ae-en/insights/news/live-news/article-3-1960105-20260805","name":"Mitrade — Blame lands on Coinkite CTO as BTC exploit loss nears $120M","type":"news_article","archive_url":"https://web.archive.org/web/20261108110513/https://www.mitrade.com/ae-en/insights/news/live-news/article-3-1960105-20260805","credibility":2,"archive_timestamp":"2026-11-08T11:05:13+00:00"},{"url":"https://www.cryptometer.io/news/coldcard-bitcoin-theft-sparks-lawsuit-over-allegedly-ignored-2025-security-warning/","name":"Cryptometer — Coldcard bitcoin theft sparks lawsuit over allegedly ignored 2025 security warning","type":"news_article","archive_url":"https://web.archive.org/web/20261108105747/https://www.cryptometer.io/news/coldcard-bitcoin-theft-sparks-lawsuit-over-allegedly-ignored-2025-security-warning/","credibility":2,"archive_timestamp":"2026-11-08T10:57:47+00:00"},{"url":"https://news.bitcoin.com/coinkite-faces-class-action-threat-as-bitcoin-wallet-bug-costs-users-over-1300-btc/","name":"Bitcoin.com News — Coinkite faces class action threat as bitcoin wallet bug costs users over 1,300 BTC","type":"news_article","archive_url":"https://web.archive.org/web/20261108104923/https://news.bitcoin.com/regulation-and-legal/coinkite-faces-class-action-threat-as-bitcoin-wallet-bug-costs-users-over-1300-btc/","credibility":2,"archive_timestamp":"2026-11-08T10:49:23+00:00"},{"url":"https://www.bit.com/knowledge-hub/coldcard-the-security-first-wallet-that-got-hacked","name":"BIT Knowledge Hub — Coldcard: The security-first wallet that got hacked","type":"other","archive_url":"http://web.archive.org/web/20261013183312/https://www.bit.com/knowledge-hub/coldcard-the-security-first-wallet-that-got-hacked","credibility":3,"archive_timestamp":"2026-10-13T18:33:12+00:00"},{"url":"https://forklog.com/en/?p=101463","name":"Forklog — Coldcard entropy flaw commentary","type":"news_article","archive_url":"https://web.archive.org/web/20261108104828/https://forklog.com/en/ledger-researchers-uncover-physical-attack-method-on-tangem-wallet/","credibility":2,"archive_timestamp":"2026-11-08T10:48:28+00:00"},{"url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","name":"TRM Labs — The Largest Hardware Wallet Exploit of 2026","type":"research","archive_url":"http://web.archive.org/web/20261103151449/https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","credibility":2,"archive_timestamp":"2026-11-03T15:14:49+00:00"},{"url":"https://protos.com/what-to-do-if-youre-a-coldcard-victim/","name":"Protos — What to do if you're a Coldcard victim","type":"news_article","archive_url":"http://web.archive.org/web/20261016084557/https://protos.com/what-to-do-if-youre-a-coldcard-victim/","credibility":2,"archive_timestamp":"2026-10-16T08:45:57+00:00"},{"url":"https://cointelegraph.com/news/coldcard-upgrade-strengthen-seed-phrase-generation","name":"CoinTelegraph — Coldcard strengthens seed generation with firmware update","type":"news_article","archive_url":"http://web.archive.org/web/20261017103847/https://cointelegraph.com/news/coldcard-upgrade-strengthen-seed-phrase-generation","credibility":2,"archive_timestamp":"2026-10-17T10:38:47+00:00"},{"url":"https://www.archerlaw.com/print/v2/content/11711/coldcard-security-flaw-raises-risks-for-certain-bitcoin-wallets.pdf","name":"Archer Law — Coldcard security flaw raises risks for certain bitcoin wallets","type":"other","archive_url":"https://web.archive.org/web/20261108105305/https://www.archerlaw.com/print/v2/content/11711/coldcard-security-flaw-raises-risks-for-certain-bitcoin-wallets.pdf","credibility":2,"archive_timestamp":"2026-11-08T10:53:05+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-08-10T23:06:36.470807+00:00","updated_at":"2026-11-08T11:10:52.926901+00:00"},"source_quality":{"total":20,"tier1":0,"tier2":6,"tier3":0,"unrated":14},"follower_count":null,"content_updated_at":"2026-11-03T23:16:52.083Z","last_fact_checked_at":"2026-10-28T00:41:37.878Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}