Coldcard maker Coinkite is facing renewed scrutiny after CEO NVK defended its security reviews around a $116 million seed-generation exploit, arguing that at least 15 external reviews or research efforts had touched COLDCARD hardware, firmware, random-number generator tools, or release controls before the defect was found. The weakness was traced to a March 2021 build configuration error that selected a weak software RNG, cutting effective seed strength to as little as 40 bits from the intended 128.
NVK said two paid third-party product reviews were completed before the incident — one covering Mk4 in 2022 and another covering Q in 2024 — and that Rob Ham’s OpenAI Cybersecurity Harness review produced 85 candidate findings but missed the seed-generation defect. He wrote that “the uncomfortable truth is that it took a new AI model to find what humans couldn’t.” Bitcoin developer Luke Dashjr challenged that claim, saying he had privately shared findings with Coinkite and that it was false to suggest only a sophisticated model could identify RNG problems. James O’Beirne’s earlier posts also resurfaced; he said he began examining Coldcard firmware in May 2025 and raised concerns about the libngu library and hardcoded constants in its software fallback.
TRM Labs estimated in August that roughly 1,816 BTC was stolen from more than 5,200 addresses across four waves beginning July 30. Galaxy Research tracked one attacker swapping about 10% of stolen Bitcoin through THORChain into Ether. Coinkite’s security page still lists a separate technical postmortem as pending and warns that firmware updates cannot repair existing affected seeds. Recommended releases are 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q.
In a separate investigation, blockchain analytics firm Elliptic detailed how wallets associated with the massive Binance theft laundered stolen NEAR through six throwaway tokens. About $6.4 billion left Binance wallets on October 29, and the FBI attributed the attack to North Korea under the TraderTraitor designation. On NEAR, roughly 117,000 NEAR entered the scheme and almost the same amount left, worth about $430,000 at reporting time. Each token cost about 25 NEAR, or $90, to create, and five of six token creators were funded by a wallet that had already sold an earlier token, forming a laundering chain.
Elliptic found that network wallets made every sale of all six tokens and bought every unit of five tokens. Outside participation was under 1% of FUK volume, almost entirely small first-day buys. The firm argued the purpose is delay rather than concealment, with each extra hop costing investigators time. It also said about 11.8 million NEAR, worth roughly $43.7 million, remained unmoved. The technique mirrors earlier laundering seen after the Bybit theft through a worthless TRON token, and Elliptic recommended exchanges recheck deposits as its public blocklist grows.
