Coldcard / Coinkite
Summary
Coinkite is a Toronto-based Canadian company founded in 2013 that manufactures Bitcoin-only hardware products, most notably the Coldcard hardware wallet. In July 2026, a firmware vulnerability introduced in March 2021 — which caused seed generation to rely on a weak software pseudorandom number generator instead of the device's hardware entropy source — was actively exploited, resulting in the theft of approximately 1,816 BTC (roughly $116 million) from over 5,200 wallet addresses. Coinkite acknowledged the flaw, released patched firmware, and faces class-action litigation threats; the perpetrators have not been publicly identified.
Connected Entities
1 entities- + 6 more
Timeline(17 events)
2013-01-01
Coinkite Inc. founded in Toronto, Canada by Rodolfo Novak and Peter Gray, initially as a Bitcoin exchange and web wallet platform.
Policy Commons / Coinkite company overview2016-01-01
Coinkite discontinues its web wallet and exchange services, citing regulatory challenges and DDoS attacks, pivoting to hardware products.
Policy Commons / Coinkite company overview2017-01-01
Coldcard hardware wallet first released. Mk1 and subsequent models follow.
About Coldcard — coldcard.com2020-11-18
Coinkite changes Coldcard firmware license from GPLv3 to MIT + Commons Clause, making the firmware source-available but no longer freely forkable or open-source by OSI definition.
Coldcard's Source-Available License Left a $100M Entropy Bug Unguarded — TFTC2020-11-07
Shift Crypto and Nunchuk responsibly disclose a multisig xpub-substitution vulnerability to Coinkite.
Remote multisig theft attack on the Coldcard hardware wallet — Benma's Blog2021-01-08
Coinkite releases firmware version 3.2.1 patching the multisig verification flaw. CEO Novak separately describes the responsible disclosure as 'PR terrorism' on a podcast.
Remote multisig theft attack on the Coldcard hardware wallet — BitBox Swiss2021-03-01
Firmware version 4.0.1 released. A build configuration error in this release causes seed generation to use MicroPython's Yasmarang software PRNG fallback instead of the STM32 hardware TRNG, introducing the entropy vulnerability. The bug goes undetected.
Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware — Block Engineering Blog2023-02-14
Coldcard Q announced — featuring a full QWERTY keyboard, QR scanner, and AAA battery power for true air-gapped operation.
Coinkite's New Bitcoin Hardware Wallet Looks Like BlackBerry, Takes AAA Batteries — CoinDesk2025-05-01
Bitcoin developer James O'Beirne reportedly flags concerns about the libngu library's RNG path to Coinkite during a firmware audit. According to O'Beirne, CTO Peter Gray responds that the company would already know if something were wrong. No fix is issued.
Coinkite Was Warned 14 Months Early About the Coldcard Flaw — Phemex2026-07-30
Active exploitation of the firmware entropy vulnerability begins. First wave drains approximately 594 BTC (~$38 million) from roughly 500 wallet addresses in approximately 25 minutes. Coinkite discloses the vulnerability and issues an emergency firmware advisory.
Coldcard exploit reignites Bitcoin self-custody debate — CoinDesk2026-07-30
Block's Bitcoin Engineering and Security teams publish a technical advisory on the COLDCARD PRNG fallback, disclosing the Yasmarang flaw and 32-bit reseed limitation. Publication was accelerated due to active exploitation already underway.
Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware — Block Engineering Blog2026-08-02
Coinkite draws separate criticism for revealing it had retained customer purchase email addresses indefinitely despite prior public statements suggesting a 90-day deletion policy.
Coinkite Under Fire for Retaining Customer Emails — Bitcoin.com News2026-08-04
Total confirmed theft passes $116 million across multiple waves. Bitcoin developer James O'Beirne publishes analysis linking CTO Peter Gray to the vulnerable libngu code via GPG commit signatures on the pseudonymous 'switck' GitHub account.
Bitcoin owners rocked by $116 million hack — Fortune2026-08-07
Coinkite suspends automated customer data deletion, citing anticipated legal obligations from the security incident. Customers given opt-out option.
Coldcard Maker Suspends Data Deletion as Legal Proceedings Loom — Crypto Times2026-08-17
CoinDesk publishes a detailed account of how the firmware bug went unnoticed for years, including analysis of the license change and security research community criticism of Coinkite's disclosure response culture.
How a bug in Coldcard's code went unnoticed for years, leading to $100 million in hacked funds — CoinDesk2026-08-21
No criminal charges against Coinkite, Rodolfo Novak, or Peter Gray have been publicly confirmed. No class-action complaint has been formally served as of this date. Patched firmware is available for all affected models.
Coinkite Updates COLDCARD After Seed Flaw — Crypto TimesDecision Log
- #1publish⛓ pending8/21/2026, 5:07:23 PMhash: 5mMbjUQAzaHYQVXa73w9YfiT5deLBc4iR3YY1MyaoNuQ
24 of 31 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/21/2026, 5:07:11 PM
last updated: 8/21/2026, 8:06:30 PM
avoid.net — verified advice for a post-truth world