Coinkite
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 15 → 27. Problems weighed by who is responsible: concerns that are not fraud −22, the subject's own conduct −15, incidents the subject suffered −10, problems around the subject, caused by others −1.6; legitimacy credit long-running +10; a recent unresolved incident −9.4. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -15 |
| Concerns that are not fraud | -22 |
| Incidents it suffered (e.g. hacks) | -10 |
| Problems around it, caused by others | -1.6 |
| Long-running | +10 |
| Recent unresolved incident | -9.4 |
| Sum | 17 |
Score: 27/100 (kept between 0 and 100)
How scoring works →Summary
Coinkite Inc. is a small, privately held Toronto-based Bitcoin hardware company that manufactures the Coldcard wallet. A firmware defect introduced into Coldcard seed generation in March 2021 went undetected for roughly five years — including, per public claims from the developer who flagged it, a specific warning to Coinkite in May 2025 that was dismissed — until attackers began draining wallets on July 30, 2026, ultimately taking an estimated 1,816 BTC (roughly $116–155 million) from more than 5,200 victims. Coinkite has publicly apologized and shipped fixed firmware, but now faces credible, still-unfiled class-action and product-liability litigation threats from law firms in Canada and the UK, alongside separate allegations — unconfirmed by the company — that its own CTO authored the flawed code.
Connected Entities
4 entities · 60 linked investigations- Coldcard Wallet (Coinkite Firmware Exploit)→mentioned with→Coinkite(70%)
- Coinkite→mentioned with→Bitcoin(70%)
- Coinkite→mentioned with→Trezor(60%)
- Trezor→mentioned with→Bitcoin(65%)
- Coinkite→mentioned with→Coldcard Wallet (Coinkite Firmware Exploit)(75%)
- Coldcard Wallet (Coinkite Firmware Exploit)→mentioned with→Bitcoin(70%)
Connected Through
4 shared actors · 446 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □Trezororganizationalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0AI-Powered Crypto Phishing Infrastructure 2026·0Fake Trezor Support Social Engineering — $282M Heist·0IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026·0Patrick Steven Yaroch — FBI Agent Crypto Theft·0
- ♦Coinkitetokenalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)·0Coldcard Fake Hardware Audit Phishing Campaign·0Coinkite / Coldcard·5Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)·11
- ♦Coldcard Wallet (Coinkite Firmware Exploit)token
Timeline(10 events)
2013
Coinkite Inc. is incorporated in Toronto by Rodolfo Novak and Peter Gray, following earlier collaboration on Bitcoin projects from around 2011.
Ivey Business School Coinkite ProfileMarch 2021
A firmware change routes Coldcard seed generation through a software library ('libngu') instead of the device's hardware random-number generator, reportedly stemming from a commit made around this time.
Cryptopolitan / CoinDesk reporting on Coinkite CTO code linkageMarch 2021
Coinkite publishes firmware version 4.0.0 ('All New Code, Same Great Features'), the first release containing the vulnerable seed-generation code; the flaw persists through firmware 4.1.9.
Coinkite BlogMay 2025
Bitcoin developer James O'Beirne says he flagged the suspicious 'libngu' randomness-handling library to Coinkite during a firmware audit and was told the issue would probably have surfaced already if it were real; Coinkite has not confirmed the specifics of this account.
CoinDesk / Phemex Academy30 July 2026
Exploitation begins; an initial wave drains roughly 594 BTC (~$38 million) from about 500 Coldcard wallets within 25–41 minutes. Coinkite publishes its first Coldcard Security Advisory the same day.
Coinkite Blog / TRM Labs1 August 2026
Coinkite updates its security advisory with expanded technical guidance and mitigation steps for affected users.
Coinkite BlogAugust 2026
Total attack losses across four waves reach an estimated 1,816 BTC (~$116 million) from over 5,200 addresses by August 3; blockchain monitors Galaxy Research and Elliptic later put combined losses as high as roughly $130-155 million. CEO Rodolfo Novak publicly apologizes and says the company takes 'full accountability for the firmware bug.'
TRM Labs / TechCrunch / Globe and MailAugust 2026
Coinkite reverses its customer data-deletion policy, citing the security incident and anticipated legal proceedings; the company had previously routinely erased customer records beyond email and country of residence.
CryptopolitanAugust 2026
James O'Beirne publishes analysis alleging that GPG-signed commits to the vulnerable library are traceable to Coinkite CTO Peter Gray, the same person he says dismissed his May 2025 warning; Coinkite does not publicly respond to the claim.
Cryptopolitan / Bitcoin Ethereum NewsAugust 2026
Toronto firm WeirFoulds LLP (with London's Edmonds Marshall McMahon) and UK firms Fieldfisher and Irwin Mitchell publish legal guidance for victims outlining product-liability and negligence claims against Coinkite, plus asset-tracing options; 117 Partners begins organizing victims for potential coordinated claims. No class-action suit is confirmed as filed as of this period.
WeirFoulds / Globe and MailDecision Log
- slot 455360512 · hash 44L3PfYsjR7bbsQzUSK2wV8say7671MxsiMSjYaw6aYn
- slot 446288093 · hash H3wu7b7znHjwuLfDZHybnshBDDE7eBwiE2x3DvhQpbAZ
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/11/2026, 11:23:31 PM
last updated: 10/10/2026, 6:41:30 PM
9 viewsavoid.net — verified advice for a post-truth world