Coinkite CEO: Coldcard firmware vulnerability caused a loss of approximately 1816 BTC

According to Bitcoin News monitoring, Coinkite CEO Rodolfo Novak (NVK) stated that a new AI model discovered a Coldcard vulnerability that was missed by human reviewers, which Bitcoin developers have disputed. This vulnerability exists in firmware versions 4.1 and later and can bypass the hardware random number generator.

Between July 30 and August 4, over 5,200 addresses lost approximately 1,816 BTC, worth about $116 million. NVK mentioned that there had been at least 15 prior reviews.

James O'Beirne stated that he privately pointed out issues with Coldcard's random number generation in May 2025. Firmware updates can fix issues for new devices but cannot fix old mnemonic phrases; affected users need to generate new mnemonic phrases.