Audit log

Every state-changing event for Coinkite / Coldcard: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-17 12:05:58Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   3hByZWRE81My…bEiksEaycopysha256 → base58

   verifying row…

   canonical bytes (29952 B) ▸

   {"actor":"system:backfill","investigation_id":"fa3e4739-2493-471f-b16a-4a0503f66079","kind":"publish","page_slug":"coinkite-coldcard","published_at":"2026-08-17T12:05:58.411Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coinkite / Coldcard","sections":[{"content":"Coinkite Inc. is a Bitcoin-only hardware security company headquartered in Toronto, Canada, founded in 2013 by Rodolfo Novak (known online as NVK) and Peter Gray. The two founders previously worked together at Ripe Apps and built btclook.com, a blockchain explorer, before pivoting to hardware wallets. Coinkite pivoted from a web wallet to hardware products in the mid-2010s. Its flagship product, the Coldcard hardware wallet, stores cryptographic private keys in an air-gapped environment and had been broadly praised by security researchers and the Bitcoin community as among the most secure self-custody solutions available. The company also produces Tapsigner, Opendime, and Satscard products, which were not reported as affected by the 2026 vulnerability.","heading":"Company Background","severity":"low","sources":[{"credibility":2,"name":"Rodolfo Novak: A Decade of Bitcoin Entrepreneurship (Seetee Podcast)","type":"other","url":"https://www.seetee.io/podcast/s2e2/rodolfo-novak-a-decade-of-bitcoin-entrepreneurship/"},{"credibility":2,"name":"How Coinkite Defines Cypherpunk Bitcoin Security (Bitcoin Magazine)","type":"news_article","url":"https://bitcoinmagazine.com/business/how-coinkite-defines-cypherpunk-bitcoin-security"},{"credibility":1,"name":"CBC News: What we know about the ongoing Coldcard hack","type":"news_article","url":"https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582"}]},{"content":"A build configuration error introduced in Coldcard firmware version 4.0.0, released on approximately March 17, 2021, caused affected devices to generate wallet seed phrases using MicroPython's Yasmarang software pseudorandom number generator (PRNG) rather than the STM32 chip's hardware true random number generator (TRNG). The root cause was a single preprocessor guard that checked whether the macro MICROPY_HW_ENABLE_RNG was defined rather than whether it was set to a truthy value; since 0 is still 'defined' in C preprocessor terms, the check always evaluated as true and routing always fell back to the weaker software path. This collapsed effective entropy from the intended 128 bits to approximately 40 bits on Mk2 and Mk3 devices and approximately 72 bits on Mk4, Mk5, and Q models. The faulty code originated in libngu, a randomness library published on GitHub under the pseudonymous account 'switck.' An attacker who could sufficiently constrain a device's UID, timer state, and prior RNG-call history could reproduce candidate seed streams offline without physical access to any device, then verify candidates by deriving Bitcoin addresses and comparing them to the public blockchain. The flaw remained in production for over five years before exploitation. The affected firmware versions were 4.0.0 through 4.1.9 for Mk2 and Mk3 devices, all Mk4 and Mk5 firmware before 5.6.0, and Q firmware before 1.5.0Q.","heading":"The Firmware Vulnerability (CVE: March 2021 Build Error)","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: The Largest Hardware Wallet Exploit of 2026 — Inside the $116M Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":2,"name":"The Hacker News: Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes","type":"news_article","url":"https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html"},{"credibility":2,"name":"Blockhead: A five-year-old Coldcard bug let hackers guess bitcoin wallet keys, Coinkite confirms","type":"news_article","url":"https://www.blockhead.co/2026/08/03/coldcard-hardware-wallets-shipped-with-broken-randomness-for-five-years-coinkite-confirms/"},{"credibility":1,"name":"Fortune: Bitcoin owners rocked by $116 million hack","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":2,"name":"Phemex Academy: Coinkite Was Warned 14 Months Early About the Coldcard Flaw","type":"news_article","url":"https://phemex.com/academy/coldcard-security-flaw-warning"}]},{"content":"The exploit became active on July 30, 2026. According to TRM Labs and multiple news outlets, the attack unfolded across at least four distinct waves. In the first wave on July 30, approximately 1,083 BTC (roughly $70.2 million) was drained in 41 minutes from 1,196 addresses. A second wave on July 31 drained approximately 594 BTC (roughly $38 million) in approximately 25 minutes from around 500 single-signature wallets. A third wave spanned from late on the same Friday through Saturday morning, taking 208 BTC from 1,912 addresses. A fourth wave added further losses detected on the following Monday. CBC News, citing Galaxy Research blockchain analysis, reported three confirmed waves plus additional smaller incidents yielding approximately 1,596 BTC from around 7,300 addresses, with a possible fourth wave that could push cumulative losses to approximately 2,055 BTC (roughly $130 million). Fortune and TRM Labs reported a total of approximately 1,816 BTC ($116 million) across 5,200 addresses at the time of their reporting. The Globe and Mail reported a figure of over $155 million. The variance in figures reflects different measurement timestamps as the attacks were ongoing at the time of publication. TRM Labs characterized this as the third-largest crypto hack of 2026 and the largest hardware wallet exploit in crypto history, bringing the 2026 year-to-date crypto theft total to over $1.2 billion across 276 incidents. On-chain analysis by TRM Labs found the majority of stolen funds pooled at a small number of attacker-controlled addresses, with limited observed laundering activity as of early August 2026: one 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash on August 4. Transaction pattern differences among the waves suggested to TRM Labs that multiple independent attackers may have exploited the vulnerability rather than a single coordinated actor. North Korea-linked groups were specifically noted as unlikely perpetrators based on the unsophisticated laundering pattern. Approximately 90% of stolen funds remained unmoved as of early August 2026.","heading":"Attack Timeline and Financial Losses","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: The Largest Hardware Wallet Exploit of 2026 — Inside the $116M Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"Fortune: Bitcoin owners rocked by $116 million hack","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":1,"name":"CBC News: What we know about the ongoing Coldcard hack","type":"news_article","url":"https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582"},{"credibility":1,"name":"The Globe and Mail: FTX claims broker now courting victims of a $155 million hack of a Canadian bitcoin firm","type":"news_article","url":"https://www.theglobeandmail.com/business/article-ftx-claims-broker-now-courting-victims-155-million-coinkite-inc/"},{"credibility":1,"name":"TechCrunch: Hackers steal over $130M by exploiting bug in offline hardware wallets","type":"news_article","url":"https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/"},{"credibility":2,"name":"CoinDesk: Coldcard's $38 million exploit shakes faith in self-custody","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"}]},{"content":"According to reporting by multiple outlets including Crypto Times, Bitcoin World, and Phemex, Bitcoin developer James O'Beirne audited Coldcard's firmware in May 2025 and flagged the RNG vulnerability to Coinkite approximately 14 months before the July 2026 attacks. O'Beirne reportedly recommended that Coinkite abandon libngu and link directly against libsecp256k1. According to O'Beirne's account as reported by these outlets, Coinkite dismissed the concern with a response to the effect that the flaw would likely have been discovered already if it were real — an absence-of-evidence argument that security researchers have noted is inapplicable to entropy flaws because weak key generation produces wallets with no visible symptoms to users. Coinkite has not publicly addressed this characterization of its response to O'Beirne's 2025 warning as of the time of this investigation. These accounts reflect O'Beirne's characterization of events; Coinkite has not confirmed or denied the specifics of the exchange.","heading":"Prior Warning Allegedly Dismissed (May 2025)","severity":"high","sources":[{"credibility":2,"name":"Crypto Times: From Trusted Vendor to Insider Job? Coinkite CTO Now Linked to $110M Coldcard Hack Code","type":"news_article","url":"https://www.cryptotimes.io/2026/08/09/from-trusted-vendor-to-insider-job-coinkite-cto-now-linked-to-110m-coldcard-hack-code/"},{"credibility":3,"name":"Bitcoin World: Coinkite CTO Accused of Ignoring Prior Warning on Coldcard Code Flaw","type":"news_article","url":"https://bitcoinworld.co.in/coinkite-cto-ignored-warning-coldcard-flaw/"},{"credibility":2,"name":"Phemex Academy: Coinkite Was Warned 14 Months Early About the Coldcard Flaw","type":"news_article","url":"https://phemex.com/academy/coldcard-security-flaw-warning"}]},{"content":"On August 4, 2026, Bitcoin developer James O'Beirne published a cryptographic analysis alleging that Coinkite co-founder and CTO Peter Gray authored the libngu library under the pseudonymous GitHub account 'switck' (also rendered 'Switck'). According to O'Beirne's analysis as reported by Cryptopolitan, Crypto Times, Gate News, and CryptoNews.net, 58 commits in the relevant repository attributed to the 'switck' account carry valid GPG signatures made with Gray's personal key — the same key he used to sign other commits under his actual name 'Peter D. Gray' in the same codebase. The 'switck' account itself never uploaded a separate public key. O'Beirne's analysis stated that the cryptographic evidence demonstrated the two identities belonged to the same person. As of early August 2026, neither Peter Gray nor Coinkite has publicly addressed or responded to this identity analysis. This remains an allegation based on cryptographic analysis by a third-party researcher; no court has adjudicated the matter, and no law enforcement agency has issued findings. The significance of the pseudonym, if the identity link is accurate, is that it raises questions about whether the flaw was introduced by Coinkite's own CTO and whether the company's response to O'Beirne's 2025 warning was influenced by Gray's authorship of the flagged code. These remain alleged and unproven as legal or factual conclusions.","heading":"Alleged Link Between CTO Peter Gray and the Vulnerable Library","severity":"high","sources":[{"credibility":2,"name":"Cryptopolitan: Coinkite CTO Peter Gray linked to the code behind the $114M Coldcard hack","type":"news_article","url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/"},{"credibility":2,"name":"Crypto Times: From Trusted Vendor to Insider Job? Coinkite CTO Now Linked to $110M Coldcard Hack Code","type":"news_article","url":"https://www.cryptotimes.io/2026/08/09/from-trusted-vendor-to-insider-job-coinkite-cto-now-linked-to-110m-coldcard-hack-code/"},{"credibility":2,"name":"Gate News: Coinkite CTO Implicated in Coldcard Vulnerability Incident","type":"news_article","url":"https://www.gate.com/news/detail/coinkite-cto-implicated-in-coldcard-vulnerability-incident-that-triggered-23215232"},{"credibility":2,"name":"CryptoNews.net: Blame lands on Coinkite CTO as BTC exploit loss nears $120M","type":"news_article","url":"https://cryptonews.net/news/security/33248351/"}]},{"content":"Coinkite publicly disclosed the firmware flaw on or around July 30, 2026, the same day as the first attack wave. CEO Rodolfo Novak (NVK) issued guidance: 'If you generated a seed using a Coldcard wallet, move your funds now.' The company released emergency firmware patches on July 31, 2026 — version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for the Q model, and version 6.6.0X and 6.6.0QX for edge builds. Coinkite acknowledged that the firmware fix prevents future vulnerable seeds but does not protect seeds already generated on affected firmware; users must generate entirely new seeds on patched hardware and migrate all funds. In a public statement, the company said: 'The last three days have been some of the hardest in this company's history, and for a lot of the people reading this, they've been something much worse.' Coinkite told Bloomberg it was focused on helping affected customers rather than estimating losses. The company noted that 'code has always been publicly viewable,' which security analysts took as an acknowledgment that the vulnerability could have been discovered earlier through open-source audits. On August 6, 2026, Coinkite announced the suspension of its standard 120-day customer data deletion policy, citing 'legal obligations arising from the security incident, including the preservation of records that may be relevant to ongoing and anticipated legal proceedings.' Customers who wished to have their data handled under the original policy could request deletion by contacting support. Coinkite has not publicly responded to the allegation linking CTO Peter Gray to the pseudonymous 'switck' GitHub account.","heading":"Company Response and Remediation","severity":"high","sources":[{"credibility":1,"name":"Fortune: Bitcoin owners rocked by $116 million hack","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":2,"name":"Blockhead: A five-year-old Coldcard bug let hackers guess bitcoin wallet keys, Coinkite confirms","type":"news_article","url":"https://www.blockhead.co/2026/08/03/coldcard-hardware-wallets-shipped-with-broken-randomness-for-five-years-coinkite-confirms/"},{"credibility":2,"name":"Crypto Times: Coldcard Maker Suspends Data Deletion as Legal Proceedings Loom","type":"news_article","url":"https://www.cryptotimes.io/2026/08/07/coldcard-maker-suspends-data-deletion-as-legal-proceedings-loom/"},{"credibility":2,"name":"CoinDesk: Coldcard's $38 million exploit shakes faith in self-custody","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"}]},{"content":"As of early August 2026, no lawsuit against Coinkite had been filed in any court that this investigation could verify. However, multiple indicators suggest litigation is anticipated. Thomas Braziel of 117 Partners — a Georgia-based firm specializing in distressed crypto claims that previously brokered nearly $1 billion in FTX bankruptcy claims — announced he was speaking with Canadian law firms and created a victim intake form. Toronto law firm WeirFoulds published legal analysis identifying two potential recovery routes for victims: product liability claims against Coinkite for selling a defective product, and tracing actions against stolen bitcoin to freeze funds during conversion attempts. Bitcoin.com News reported that victims were organizing around class action threats. Canadian victims reportedly account for more than 25% of losses according to The Globe and Mail. Coinkite's reference to 'ongoing and anticipated legal proceedings' in its August 6 data preservation notice indicates the company itself expects litigation. No SEC, CFTC, or other regulatory enforcement actions related to this incident were found in public filings or announcements as of the time of this investigation. Legal experts quoted in reporting noted that determining Coinkite's liability presents challenges, and 'finding sufficient realizable funds' across thousands of affected users was identified as a key recovery obstacle. No court ruling on the merits of any claim has been issued.","heading":"Legal and Regulatory Landscape","severity":"medium","sources":[{"credibility":1,"name":"The Globe and Mail: FTX claims broker now courting victims of $155 million hack of a Canadian bitcoin firm","type":"news_article","url":"https://www.theglobeandmail.com/business/article-ftx-claims-broker-now-courting-victims-155-million-coinkite-inc/"},{"credibility":2,"name":"WeirFoulds: The Coldcard Exploit — Why Victims May Have Two Routes to Recovery","type":"other","url":"https://www.weirfoulds.com/the-coldcard-exploit-why-victims-may-have-two-routes-to-recovery"},{"credibility":2,"name":"Crypto Times: Coldcard Maker Suspends Data Deletion as Legal Proceedings Loom","type":"news_article","url":"https://www.cryptotimes.io/2026/08/07/coldcard-maker-suspends-data-deletion-as-legal-proceedings-loom/"},{"credibility":2,"name":"Fieldfisher: Coinkite Coldcard hack — what victims need to know","type":"other","url":"https://www.fieldfisher.com/en/insights/coinkite-coldcard-hack-what-victims-need-to-know"}]},{"content":"The Coldcard exploit generated significant commentary about the risks of Bitcoin self-custody. Bitcoin commentator Guy Swann described it as 'the worst hit in bitcoin history to the most knowledgeable' users, distinguishing it from exchange hacks that typically target less technically sophisticated holders. ARK Invest's Lorenzo Valente stated that consumers have 'traded counterparty risk for software risk, hardware risk, supply-chain risk.' Casa CEO Nick Neuman criticized recommended remediation steps as impractical for mainstream users. CoinDesk reported that the incident may push some investors toward regulated custodians and spot Bitcoin ETFs. An AI-assisted security audit conducted in the wake of the incident reportedly identified 85 additional critical bugs across the broader Bitcoin wallet ecosystem, suggesting to analysts that Coldcard may represent a systemic rather than isolated vulnerability in hardware wallet entropy handling. Kraken's chief security officer was reported calling for 'mandatory independent entropy testing across all hardware wallet manufacturers.' The incident did not produce significant market-wide price impact; Bitcoin and Ethereum declined less than 1% following the attack.","heading":"Industry Impact and Self-Custody Debate","severity":"medium","sources":[{"credibility":2,"name":"CoinDesk: Coldcard's exploit shakes faith in self-custody","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"},{"credibility":2,"name":"crypto.news: Coldcard's RNG flaw is still draining wallets, and an AI audit just found 85 more critical bugs","type":"news_article","url":"https://crypto.news/coldcard-rng-flaw-bitcoin-wallet-ai-audit/"},{"credibility":1,"name":"Forbes: 'I Did Everything Right' — AI Warning After $116 Million Bitcoin Hack","type":"news_article","url":"https://www.forbes.com/sites/boazsobrado/2026/08/04/i-did-everything-right-ai-warning-after-116-million-bitcoin-hack/"}]}],"sources_used":[{"credibility":1,"name":"Fortune: Bitcoin owners rocked by $116 million hack — What we know about the Coldcard exploit","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":1,"name":"TechCrunch: Hackers steal over $130M by exploiting bug in offline hardware wallets","type":"news_article","url":"https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/"},{"credibility":2,"name":"TRM Labs: The Largest Hardware Wallet Exploit of 2026 — Inside the $116M Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"CBC News: What we know about the ongoing Coldcard hack that's stolen over $100M worth of bitcoin","type":"news_article","url":"https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582"},{"credibility":1,"name":"The Globe and Mail: FTX claims broker now courting victims of a $155 million hack of a Canadian bitcoin firm","type":"news_article","url":"https://www.theglobeandmail.com/business/article-ftx-claims-broker-now-courting-victims-155-million-coinkite-inc/"},{"credibility":2,"name":"The Hacker News: Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes","type":"news_article","url":"https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html"},{"credibility":2,"name":"Blockhead: A five-year-old Coldcard bug let hackers guess bitcoin wallet keys, Coinkite confirms","type":"news_article","url":"https://www.blockhead.co/2026/08/03/coldcard-hardware-wallets-shipped-with-broken-randomness-for-five-years-coinkite-confirms/"},{"credibility":2,"name":"Cryptopolitan: Coinkite CTO Peter Gray linked to the code behind the $114M Coldcard hack","type":"news_article","url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/"},{"credibility":2,"name":"Crypto Times: From Trusted Vendor to Insider Job? Coinkite CTO Now Linked to $110M Coldcard Hack Code","type":"news_article","url":"https://www.cryptotimes.io/2026/08/09/from-trusted-vendor-to-insider-job-coinkite-cto-now-linked-to-110m-coldcard-hack-code/"},{"credibility":2,"name":"Crypto Times: Coldcard Maker Suspends Data Deletion as Legal Proceedings Loom","type":"news_article","url":"https://www.cryptotimes.io/2026/08/07/coldcard-maker-suspends-data-deletion-as-legal-proceedings-loom/"},{"credibility":2,"name":"Gate News: Coinkite CTO Implicated in Coldcard Vulnerability Incident","type":"news_article","url":"https://www.gate.com/news/detail/coinkite-cto-implicated-in-coldcard-vulnerability-incident-that-triggered-23215232"},{"credibility":2,"name":"CryptoNews.net: Blame lands on Coinkite CTO as BTC exploit loss nears $120M","type":"news_article","url":"https://cryptonews.net/news/security/33248351/"},{"credibility":3,"name":"Bitcoin World: Coinkite CTO Accused of Ignoring Prior Warning on Coldcard Code Flaw","type":"news_article","url":"https://bitcoinworld.co.in/coinkite-cto-ignored-warning-coldcard-flaw/"},{"credibility":2,"name":"Phemex Academy: Coinkite Was Warned 14 Months Early About the Coldcard Flaw","type":"news_article","url":"https://phemex.com/academy/coldcard-security-flaw-warning"},{"credibility":2,"name":"CoinDesk: Coldcard's $38 million exploit shakes faith in self-custody, may push investors to ETFs","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"},{"credibility":1,"name":"Forbes: 'I Did Everything Right' — AI Warning After $116 Million Bitcoin Hack","type":"news_article","url":"https://www.forbes.com/sites/boazsobrado/2026/08/04/i-did-everything-right-ai-warning-after-116-million-bitcoin-hack/"},{"credibility":2,"name":"WeirFoulds LLP: The Coldcard Exploit — Why Victims May Have Two Routes to Recovery","type":"other","url":"https://www.weirfoulds.com/the-coldcard-exploit-why-victims-may-have-two-routes-to-recovery"},{"credibility":2,"name":"Fieldfisher: Coinkite Coldcard hack — what victims need to know","type":"other","url":"https://www.fieldfisher.com/en/insights/coinkite-coldcard-hack-what-victims-need-to-know"},{"credibility":2,"name":"crypto.news: Coldcard's RNG flaw is still draining wallets, and an AI audit just found 85 more critical bugs","type":"news_article","url":"https://crypto.news/coldcard-rng-flaw-bitcoin-wallet-ai-audit/"},{"credibility":2,"name":"Bitcoin Magazine: How Coinkite Defines Cypherpunk Bitcoin Security","type":"news_article","url":"https://bitcoinmagazine.com/business/how-coinkite-defines-cypherpunk-bitcoin-security"}],"summary":"Coinkite is a Toronto-based Bitcoin hardware company founded in 2013 by Rodolfo Novak and Peter Gray, best known for its Coldcard hardware wallet, which had been widely regarded as one of the most secure Bitcoin signing devices available. Beginning July 30, 2026, attackers exploited a five-year-old firmware flaw in Coldcard devices — a build configuration error introduced in March 2021 that caused seed generation to fall back on a weak software pseudorandom number generator instead of the device's hardware entropy source — draining an estimated $116 million to $130 million in Bitcoin from more than 5,200 addresses across at least four attack waves, making it the largest hardware wallet exploit in crypto history. Legal proceedings are anticipated and Coinkite has suspended its data deletion policy while victims and law firms assess potential litigation.","timeline":[{"date":"2021-03-01","event":"Vulnerable commit introduced into libngu library, replacing hardware RNG calls with weak software PRNG (Yasmarang). The flaw entered the codebase under the pseudonymous account 'switck.'","source":"Crypto Times / TRM Labs","source_url":"https://www.cryptotimes.io/2026/08/09/from-trusted-vendor-to-insider-job-coinkite-cto-now-linked-to-110m-coldcard-hack-code/"},{"date":"2021-03-17","event":"Coldcard firmware version 4.0.0 officially released, shipping the entropy flaw to all affected device lines.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html"},{"date":"2025-05-01","event":"Bitcoin developer James O'Beirne reportedly warned Coinkite about the flawed RNG implementation in libngu and recommended migrating away from the library. According to O'Beirne, Coinkite dismissed the concern, citing absence of prior discovery as evidence of safety. Coinkite has not confirmed the specifics of this exchange.","source":"Phemex Academy / Crypto Times","source_url":"https://phemex.com/academy/coldcard-security-flaw-warning"},{"date":"2026-07-30","event":"First attack wave: approximately 1,083 BTC (~$70.2 million) drained from 1,196 addresses in 41 minutes. Coinkite publicly discloses the firmware flaw the same day.","source":"Fortune / TRM Labs","source_url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"date":"2026-07-31","event":"Second attack wave: approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets. Coinkite releases emergency firmware patches (v4.2.0 for Mk2/Mk3; v5.6.0 for Mk4/Mk5; v1.5.0Q for Q model).","source":"Fortune / Blockhead / TRM Labs","source_url":"https://www.blockhead.co/2026/08/03/coldcard-hardware-wallets-shipped-with-broken-randomness-for-five-years-coinkite-confirms/"},{"date":"2026-08-02","event":"Cumulative losses reported at over 1,367 BTC (~$88.6 million) from 4,500+ addresses across three waves, per Blockhead.","source":"Blockhead","source_url":"https://www.blockhead.co/2026/08/03/coldcard-hardware-wallets-shipped-with-broken-randomness-for-five-years-coinkite-confirms/"},{"date":"2026-08-03","event":"Fortune reports cumulative losses at approximately 1,816 BTC ($116 million) from 5,200+ addresses. TRM Labs publishes detailed on-chain analysis. Bloomberg reports on the attack.","source":"Fortune / TRM Labs","source_url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"date":"2026-08-04","event":"TechCrunch reports losses exceeding $130 million. James O'Beirne publishes cryptographic analysis alleging CTO Peter Gray authored the vulnerable libngu library under the pseudonym 'switck,' based on GPG signatures on 58 commits. Neither Gray nor Coinkite responds publicly.","source":"TechCrunch / Cryptopolitan / Crypto Times","source_url":"https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/"},{"date":"2026-08-04","event":"One 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash observed in on-chain data, representing initial laundering activity. Approximately 90% of stolen funds remain unmoved.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-08-06","event":"Coinkite announces suspension of its standard 120-day customer data deletion policy, citing legal obligations and 'anticipated legal proceedings.' WeirFoulds LLP publishes legal analysis outlining two potential recovery routes for victims.","source":"Crypto Times / WeirFoulds","source_url":"https://www.cryptotimes.io/2026/08/07/coldcard-maker-suspends-data-deletion-as-legal-proceedings-loom/"},{"date":"2026-08-07","event":"Thomas Braziel of 117 Partners announces outreach to Canadian law firms on behalf of victims, creating an intake form for affected users. Toronto law firm WeirFoulds assesses potential litigation.","source":"The Globe and Mail","source_url":"https://www.theglobeandmail.com/business/article-ftx-claims-broker-now-courting-victims-155-million-coinkite-inc/"},{"date":"2026-08-09","event":"Crypto Times publishes additional reporting on the alleged connection between Peter Gray and the switck pseudonym, framing unresolved governance questions about whether Coinkite's own CTO authored and then dismissed warnings about the vulnerable dependency.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/09/from-trusted-vendor-to-insider-job-coinkite-cto-now-linked-to-110m-coldcard-hack-code/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2c5a826c-95b2-4f24-b213-9333d968c8c9copy