← Coinkite / Coldcardreviewed 2026-10-24 · 35 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Coinkite / Coldcard against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #8[disputed][awaiting moderator]in section: Attack Timeline and Financial Losses
“A second wave on July 31 drained approximately 594 BTC (roughly $38 million) in approximately 25 minutes from around 500 single-signature wallets.”
reviewerA second wave on July 31 drained approximately 594 BTC (~$38 million) in approximately 25 minutes from around 500 single-signature wallets.The page presents the $38M/594 BTC/500-wallet figure as a distinct 'second wave' on July 31, but independent wave-by-wave reconstructions (and CoinDesk's own 'so far' framing) show this was an early, partial estimate of the same first wave (July 30), later revised upward to the 1,083 BTC figure already given earlier in the same paragraph. The true second wave had different, unstated-on-page figures (one independent source gives ~76-284 BTC from ~1,477-1,478 addresses).Proposed correction (not yet applied)An early, partial estimate reported around July 30-31 put losses from the first wave at approximately 594 BTC (roughly $38 million) drained in approximately 25 minutes from around 500 single-signature wallets; this was a preliminary, incomplete tally of the same July 30 first wave described above, not a separate second wave, and was later superseded by the fuller 1,083 BTC figure as more on-chain data was analyzed. - #9[disputed][awaiting moderator]in the timeline
“Second attack wave: approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets. Coinkite releases emergency firmware patches (v4.2.0 for Mk2/Mk3; v5.6.0 for Mk4/Mk5; v1.5.0Q for Q model).”
reviewerSecond attack wave: approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets, same day as emergency firmware patches.Same underlying error as the Attack Timeline section's 'second wave' claim; grouped under the same defect_group. The firmware patch information in this timeline entry is independently confirmed and should be retained.Proposed correction (not yet applied)An early, partial estimate of approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets was reported around this time; this was a preliminary tally of the July 30 first wave rather than a distinct second wave, and was later superseded by a fuller count. Coinkite releases emergency firmware patches (v4.2.0 for Mk2/Mk3; v5.6.0 for Mk4/Mk5; v1.5.0Q for Q model). - #33[disputed][awaiting moderator]in section: Industry Impact and Self-Custody Debate
“Kraken's chief security officer was reported calling for 'mandatory independent entropy testing across all hardware wallet manufacturers.'”
reviewerKraken's chief security officer was reported calling for 'mandatory independent entropy testing across all hardware wallet manufacturers.'This appears to be a fabricated quotation placed in quotation marks as if verbatim. Multiple independent reports on Kraken CSO Nick Percoco's comments describe him calling for independent verification of entropy-source implementation, but none use the word 'mandatory' or frame it as a testing mandate; no source for this exact phrase could be located.Proposed correction (not yet applied)Kraken's chief security officer was reported arguing that existing hardware wallet certifications do not systematically verify that a device's approved entropy source is the one actually used in production firmware, and calling for independent verification of that link across hardware wallet manufacturers.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #29[unverifiable][awaiting moderator]in section: Legal and Regulatory Landscape
“No SEC, CFTC, or other regulatory enforcement actions related to this incident were found in public filings or announcements as of the time of this investigation.”
reviewerNo SEC, CFTC, or other regulatory enforcement actions related to this incident were found in public filings or announcements as of the time of this investigation.Consistent with everything found in this review, but verifying a true negative claim comprehensively is beyond what web search/fetch can confirm with confidence.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in section: The Firmware Vulnerability (CVE: March 2021 Build Error)
“This collapsed effective entropy from the intended 128 bits to approximately 40 bits on Mk2 and Mk3 devices and approximately 72 bits on Mk4, Mk5, and Q models.”
reviewerThe flaw collapsed effective entropy to approximately 40 bits on Mk2 and Mk3 devices and approximately 72 bits on Mk4, Mk5, and Q models.The ~40-bit figure is independently confirmed for Mk3; no source found independently states the same figure for Mk2 specifically, so the Mk2 attribution is unverified rather than contradicted. - #16[partially supported][awaiting moderator]in section: Attack Timeline and Financial Losses
“Approximately 90% of stolen funds remained unmoved as of early August 2026.”
reviewerApproximately 90% of stolen funds remained unmoved as of early August 2026 (attributed to TRM Labs).Directionally consistent with TRM's qualitative description, but the specific 90% statistic is not found in the cited TRM source for the 'early August 2026' timeframe; a matching figure traces to a different source (Galaxy Research) in a later, narrower context. - #17[partially supported][awaiting moderator]in the timeline
“One 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash observed in on-chain data, representing initial laundering activity. Approximately 90% of stolen funds remain unmoved.”
reviewerOne 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash observed; approximately 90% of stolen funds remain unmoved.Same underlying over-specification as the parallel section claim; grouped under the same defect_group. The 64.9 BTC/200 ETH figures themselves are confirmed. - #34[partially supported][awaiting moderator]in section: Industry Impact and Self-Custody Debate
“An AI-assisted security audit conducted in the wake of the incident reportedly identified 85 additional critical bugs across the broader Bitcoin wallet ecosystem, suggesting to analysts that Coldcard may represent a systemic rather than isolated vulnerability in hardware wallet entropy handling.”
reviewerAn AI-assisted security audit identified 85 additional critical bugs across the broader Bitcoin wallet ecosystem, suggesting Coldcard may represent a systemic rather than isolated vulnerability.The 85-bug figure is confirmed, but the page's framing ('suggesting to analysts... systemic') goes beyond the cited article's own hedged language, which explicitly withholds a confirmed systemic conclusion.
confirmed
27 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Company Background
“Coinkite Inc. is a Bitcoin-only hardware security company headquartered in Toronto, Canada, founded in 2013 by Rodolfo Novak (known online as NVK) and Peter Gray.”
reviewerCoinkite Inc. is a Bitcoin-only hardware security company headquartered in Toronto, founded in 2013 by Rodolfo Novak and Peter Gray.Founding year, founders, and HQ corroborated by an independent university fintech directory and Coinkite's own public interviews. - #2[confirmed][no action needed]in section: Company Background
“The two founders previously worked together at Ripe Apps and built btclook.com, a blockchain explorer, before pivoting to hardware wallets.”
reviewerThe two founders previously worked together at Ripe Apps and built btclook.com, a blockchain explorer.Corroborated by independent profile; consistent with company background reporting. - #3[confirmed][no action needed]in section: The Firmware Vulnerability (CVE: March 2021 Build Error)
“The root cause was a single preprocessor guard that checked whether the macro MICROPY_HW_ENABLE_RNG was defined rather than whether it was set to a truthy value; since 0 is still 'defined' in C preprocessor terms, the check always evaluated as true and routing always fell back to the weaker software path.”
reviewerThe root cause was a preprocessor guard checking whether MICROPY_HW_ENABLE_RNG was defined rather than truthy, so a value of 0 still passed the check.Technical root-cause description matches independent reporting closely. - #5[confirmed][no action needed]in section: The Firmware Vulnerability (CVE: March 2021 Build Error)
“The faulty code originated in libngu, a randomness library published on GitHub under the pseudonymous account 'switck.'”
reviewerThe faulty code originated in libngu, a randomness library published on GitHub under the pseudonymous account 'switck.'Corroborated across multiple outlets. - #6[confirmed][no action needed]in section: The Firmware Vulnerability (CVE: March 2021 Build Error)
“The affected firmware versions were 4.0.0 through 4.1.9 for Mk2 and Mk3 devices, all Mk4 and Mk5 firmware before 5.6.0, and Q firmware before 1.5.0Q.”
reviewerAffected firmware versions were 4.0.0-4.1.9 for Mk2/Mk3, all Mk4/Mk5 before 5.6.0, and Q before 1.5.0Q.Version ranges confirmed, with a noted minor variance between Coinkite's own advisory and third-party analysis on the exact starting version (4.0.0 vs 4.0.1). - #7[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“In the first wave on July 30, approximately 1,083 BTC (roughly $70.2 million) was drained in 41 minutes from 1,196 addresses.”
reviewerIn the first wave on July 30, approximately 1,083 BTC (~$70.2 million) was drained in 41 minutes from 1,196 addresses.Precisely corroborated by a detailed independent wave-by-wave breakdown. - #10[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“A third wave spanned from late on the same Friday through Saturday morning, taking 208 BTC from 1,912 addresses.”
reviewerA third wave spanned from late Friday through Saturday morning, taking 208 BTC from 1,912 addresses.Address count for wave 3 is independently corroborated. - #11[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“CBC News, citing Galaxy Research blockchain analysis, reported three confirmed waves plus additional smaller incidents yielding approximately 1,596 BTC from around 7,300 addresses, with a possible fourth wave that could push cumulative losses to approximately 2,055 BTC (roughly $130 million).”
reviewerCBC/Galaxy Research reported three confirmed waves plus smaller incidents totaling ~1,596 BTC from ~7,300 addresses, with a possible fourth wave pushing losses to ~2,055 BTC (~$130M).Could not directly fetch CBC's own page (403), but the specific figures attributed to Galaxy Research are independently and precisely corroborated by other contemporaneous coverage of the same Galaxy Research release. - #12[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“Fortune and TRM Labs reported a total of approximately 1,816 BTC ($116 million) across 5,200 addresses at the time of their reporting.”
reviewerFortune and TRM Labs reported a total of approximately 1,816 BTC ($116 million) across 5,200 addresses at the time of their reporting.Directly verified against both cited sources. - #13[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“The Globe and Mail reported a figure of over $155 million.”
reviewerThe Globe and Mail reported a figure of over $155 million.Directly verified. - #14[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“TRM Labs characterized this as the third-largest crypto hack of 2026 and the largest hardware wallet exploit in crypto history, bringing the 2026 year-to-date crypto theft total to over $1.2 billion across 276 incidents.”
reviewerTRM Labs characterized this as the third-largest crypto hack of 2026 and the largest hardware wallet exploit in history, with 2026 YTD theft over $1.2 billion across 276 incidents.Confirmed directly from TRM Labs' blog and corroborated independently. - #15[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“On-chain analysis by TRM Labs found the majority of stolen funds pooled at a small number of attacker-controlled addresses, with limited observed laundering activity as of early August 2026: one 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash on August 4.”
reviewerOn-chain analysis found one 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash on August 4, with 90% of stolen funds unmoved as of early August 2026.The 64.9 BTC/200 ETH figures and dates are confirmed verbatim against the cited TRM Labs source. - #18[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“Transaction pattern differences among the waves suggested to TRM Labs that multiple independent attackers may have exploited the vulnerability rather than a single coordinated actor. North Korea-linked groups were specifically noted as unlikely perpetrators based on the unsophisticated laundering pattern.”
reviewerTransaction pattern differences suggested multiple independent attackers; North Korea-linked groups were noted as unlikely perpetrators.Confirmed directly against the source. - #19[confirmed][no action needed]in section: Prior Warning Allegedly Dismissed (May 2025)
“Bitcoin developer James O'Beirne audited Coldcard's firmware in May 2025 and flagged the RNG vulnerability to Coinkite approximately 14 months before the July 2026 attacks.”
reviewerJames O'Beirne audited Coldcard's firmware in May 2025 and flagged the RNG vulnerability approximately 14 months before the July 2026 attacks.Confirmed directly against the cited source. - #20[confirmed][no action needed]in section: Prior Warning Allegedly Dismissed (May 2025)
“Coinkite dismissed the concern with a response to the effect that the flaw would likely have been discovered already if it were real — an absence-of-evidence argument that security researchers have noted is inapplicable to entropy flaws because weak key generation produces wallets with no visible symptoms to users.”
reviewerCoinkite dismissed O'Beirne's concern with an absence-of-evidence argument that security researchers say is inapplicable to entropy flaws.Confirmed; page's characterization closely tracks the cited source's own framing. - #21[confirmed][no action needed]in section: Alleged Link Between CTO Peter Gray and the Vulnerable Library
“58 commits in the relevant repository attributed to the 'switck' account carry valid GPG signatures made with Gray's personal key — the same key he used to sign other commits under his actual name 'Peter D. Gray' in the same codebase.”
reviewer58 commits attributed to the 'switck' account carry valid GPG signatures made with Peter Gray's personal key, the same key used to sign commits as 'Peter D. Gray.'Confirmed across multiple independently fetched outlets. The page correctly frames this as O'Beirne's unverified allegation rather than established fact, which matches how the underlying sources present it. - #22[confirmed][no action needed]in section: Company Response and Remediation
“CEO Rodolfo Novak (NVK) issued guidance: 'If you generated a seed using a Coldcard wallet, move your funds now.'”
reviewerCoinkite publicly disclosed the flaw around July 30, 2026, and CEO Rodolfo Novak (NVK) issued guidance to move funds now.The exact quote is not found verbatim in the page's cited Fortune source, but is corroborated as substantively accurate by independent reporting attributing this guidance to Novak's public statement. - #23[confirmed][no action needed]in section: Company Response and Remediation
“The company released emergency firmware patches on July 31, 2026 — version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for the Q model, and version 6.6.0X and 6.6.0QX for edge builds.”
reviewerCoinkite released emergency firmware patches on July 31, 2026, including v4.2.0, v5.6.0, v1.5.0Q, and edge builds v6.6.0X/v6.6.0QX.Confirmed across two independently fetched sources. - #24[confirmed][no action needed]in section: Company Response and Remediation
“In a public statement, the company said: 'The last three days have been some of the hardest in this company's history, and for a lot of the people reading this, they've been something much worse.'”
reviewerCoinkite stated: 'The last three days have been some of the hardest in this company's history, and for a lot of the people reading this, they've been something much worse.'Quote confirmed verbatim against the cited source. - #25[confirmed][no action needed]in section: Company Response and Remediation
“On August 6, 2026, Coinkite announced the suspension of its standard 120-day customer data deletion policy, citing 'legal obligations arising from the security incident, including the preservation of records that may be relevant to ongoing and anticipated legal proceedings.'”
reviewerOn August 6, 2026, Coinkite announced the suspension of its standard 120-day customer data deletion policy, citing legal obligations.Direct fetch of the Crypto Times article returned 403, but the claim is independently corroborated by other contemporaneous coverage of the same announcement. - #26[confirmed][no action needed]in section: Legal and Regulatory Landscape
“Thomas Braziel of 117 Partners — a Georgia-based firm specializing in distressed crypto claims that previously brokered nearly $1 billion in FTX bankruptcy claims — announced he was speaking with Canadian law firms and created a victim intake form.”
reviewerThomas Braziel of 117 Partners, which previously brokered nearly $1 billion in FTX bankruptcy claims, announced he was speaking with Canadian law firms and created a victim intake form.Confirmed. Coverage gap noted separately: the Globe and Mail article also reports a 2024 Delaware court finding against Braziel over misuse of receivership funds, which the page omits. - #27[confirmed][no action needed]in section: Legal and Regulatory Landscape
“Toronto law firm WeirFoulds published legal analysis identifying two potential recovery routes for victims: product liability claims against Coinkite for selling a defective product, and tracing actions against stolen bitcoin to freeze funds during conversion attempts.”
reviewerToronto law firm WeirFoulds identified two potential recovery routes: product liability claims and tracing actions against stolen bitcoin.Confirmed via secondary corroboration since the firm's own page could not be rendered directly (JS-only content). - #28[confirmed][no action needed]in section: Legal and Regulatory Landscape
“Canadian victims reportedly account for more than 25% of losses according to The Globe and Mail.”
reviewerCanadian victims reportedly account for more than 25% of losses according to The Globe and Mail.Confirmed, though the page attributes the figure to the Globe and Mail without noting that the Globe and Mail itself sourced it from Chainalysis -- a minor sourcing omission, not a factual error. - #30[confirmed][no action needed]in section: Industry Impact and Self-Custody Debate
“Bitcoin commentator Guy Swann described it as 'the worst hit in bitcoin history to the most knowledgeable' users, distinguishing it from exchange hacks that typically target less technically sophisticated holders.”
reviewerBitcoin commentator Guy Swann described it as 'the worst hit in bitcoin history to the most knowledgeable' users.Confirmed verbatim (page trims the quote slightly but preserves its substance and attribution). - #31[confirmed][no action needed]in section: Industry Impact and Self-Custody Debate
“ARK Invest's Lorenzo Valente stated that consumers have 'traded counterparty risk for software risk, hardware risk, supply-chain risk.'”
reviewerARK Invest's Lorenzo Valente stated that consumers have 'traded counterparty risk for software risk, hardware risk, supply-chain risk.'Confirmed verbatim against the cited source. - #32[confirmed][no action needed]in section: Industry Impact and Self-Custody Debate
“Casa CEO Nick Neuman criticized recommended remediation steps as impractical for mainstream users.”
reviewerCasa CEO Nick Neuman criticized recommended remediation steps as impractical for mainstream users.Confirmed, close paraphrase of a direct quote. - #35[confirmed][no action needed]in section: Industry Impact and Self-Custody Debate
“The incident did not produce significant market-wide price impact; Bitcoin and Ethereum declined less than 1% following the attack.”
reviewerThe incident did not produce significant market-wide price impact; Bitcoin and Ethereum declined less than 1% following the attack.Confirmed against the specific cited source; a minor conflicting report exists elsewhere but measures a different time window and is a lower-tier source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.