A total of 1,816 Bitcoin worth $116 million was drained from over 5,200 Coldcard wallet addresses, but the ensuing debate has centered on artificial intelligence claims. On November 9, 2026, Coinkite CEO NVK defended the security audit record of his hardware devices. NVK argued that the failure to detect the seed generation vulnerability was not mere human negligence, but rather that only advanced AI models could uncover the hidden flaw after human reviewers repeatedly missed it.
In his defense, NVK cited Rob Ham’s evaluation of the OpenAI Cybersecurity Harness as a system capable of tracking down the weakness. However, the statement immediately drew fierce backlash from Bitcoin developers, who claimed they had detected vulnerabilities in Coldcard’s code long before the exploit occurred.
Did Humans Really Fail to Find It?
Bitcoin developer Luke Dashjr refuted NVK’s claim. Dashjr maintained that human code reviewers were capable of finding the security flaw, revealing he had sent warnings directly to Coinkite through private channels long before the exploit took place.
A more specific warning came from Bitcoin Core developer James O’Beirne. Since May 2025, O’Beirne had warned Coinkite about weaknesses in the libngu library as well as constants embedded in the wallet’s software fallback. Nevertheless, the manufacturer dismissed the warnings, arguing that the physical hardware continued to function normally.
Configuration Flaw Since March 2021
Analysis from TRM Labs and Galaxy Research indicates the root cause stemmed from a build configuration mistake in March 2021 that mistakenly selected a weak software random number generator.
The error slashed seed generation entropy from the standard 128-bit to just 40-bit on older devices. This configuration flaw allowed hackers to reconstruct private keys remotely without needing physical access to the device.
The theft occurred across four attack waves starting July 30. A total of 1,816 BTC worth approximately $116 million was drained from more than 5,200 user wallet addresses.
Portion of Funds Swapped for Ether
Onchain data from Galaxy Research shows that an attacker from the third wave swapped roughly 10% of the stolen Bitcoin for Ether via the THORChain protocol. All tracking information has now been handed over to U.S. federal law enforcement.
For the owners of the more than 5,200 affected wallets, the debate over audits will not bring back their Bitcoin. Technical warnings had been submitted as early as May 2025 but were ignored, allowing the 40-bit flaw to be exploited without ever touching the devices.
Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
