Coldcard Hack: NVK invokes 15 audits, Luke Dashjr calls lies

Coin Encyclopedia Improve your knowledge of cryptos

If you created your seed on a Coldcard before summer, this quarrel doesn't change anything for you. You must always migrate to a new recovery phrase.

On November 9, Rodolfo Novak, aka NVK, posted a lengthy thread on X. He states that at least 15 external security review or research studies focused on Coldcard hardware, its firmware, its tools related to the random number generator or its publication procedures before the discovery of the defect. The lot includes two paid reviews, that of the Mk4 in 2022 and that of the Q in 2024.

He also cites a screening carried out by developer Rob Ham with the OpenAI cybersecurity tool. Result, 85 potential problems reported and several corrections, but no trace of the seed generation fault. “The inconvenient truth is that it took a new AI model to find what humans couldn’t find,” writes NVK.

The bug dates from March 2021. To create a seed (the sequence of 12 or 24 words which allows all the keys of a wallet to be reconstituted), the firmware called the MicroPython software generator instead of the intended hardware chance chip. Keys that were supposed to be impossible to find became guessable by brute force. On July 30, an initial sweep cleared 1,196 addresses in 41 minutes.

The response came the same day. Bitcoin Core developer Luke Dashjr has published nine observations about Coldcard's random generator, which he claims he first communicated privately to Coinkite. It targets generator initialization, STM32 chip error handling and repeated value detection. He specifies that he only took a quick look and does not claim that each point can be exploited. On AI, on the other hand, he does not take gloves: presenting these flaws as findable by a brilliant AI and by it alone is for him a pure and simple lie.

James O'Beirne had already said at the beginning of August that he had started peeling the firmware in May 2025. He was wondering about the libngu library and hard-coded constants in the emergency software generator. He would have been told that the configuration was correct on the physical devices. He admits he didn't insist.

The tone rises quickly. Alex Waltz accuses Coinkite of having discouraged the examination of his code, when Shinobi defends NVK by recalling that reviewers had indeed inspected the entropy system without seeing anything. And NVK, for its part, repeats that a private message expressing concern does not amount to a disclosure of a reproducible flaw.

Both camps stumble upon the same blind spot. As of August 3, Nick Percoco, Kraken's security manager, explained that auditors checked the presence of the correct generator in the code, without checking that the production firmware called it. At the end of August, Trezor added that a paid audit from March 2022, which precisely covered random generation, had been missed.

On the Coinkite side, the security status page updated on October 1 lists four independent checks targeted on the corrected firmware. She clarifies that there is no complete independent audit of each binary. The detailed technical postmortem, awaited since the summer? Still “in preparation”.

For you, the instructions have not changed one iota. The recommended versions are 5.6.3 for Mk4 and Mk5 and 1.5.3Q for Q, but an update does not migrate a seed. The only recognized exception is that a seed created with at least 50 fair die rolls and never exposed provides approximately 128 bits of entropy. For all others, new recovery phrase on an up-to-date device, then transfer of funds.

A small part of the loot has already changed hands in the right direction. On September 21, whitehats bundled 52.37 BTC linked to the Coldcard hack into a Wyoming trust responsible for returning them to victims, or just 3% of the approximately 1,800 BTC stolen.

Falling down the white rabbit hole in 2017, I went from avid reader to Editor-in-Chief of Journal du Coin. I like to get involved behind the scenes of projects to bring my vision of a decentralized future. A lover of beautiful letters, I coordinate our teams to transform technical complexity into human, precise information without unnecessary jargon. Between entrepreneurship and writing, my mission is clear: popularize tomorrow, but do it today.

The news that matters, summarized in 2 minutes. Monday to Friday, in your inbox.

This site uses Google Analytics to collect anonymous information such as the number of visitors to the site and the most popular pages.

Machine-translated from French