Coinkite
Last changed 2026-11-03 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score was recalculated from the page's findings, 59 → 65. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -19.2 |
| Problems around it, caused by others | -4.5 |
| Long-running | +10 |
| Regulated | +5 |
| Accepted community evidence | -1.4 |
| Sum | 55 |
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 65/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-03 · 5 of 7 claims confirmed · 1 need better sources · 1 disputed
anchored·4c5G9g…ChLLSummary
Coinkite Inc. is a Toronto-based hardware wallet maker best known for the Coldcard line, long regarded in the Bitcoin community as a security-focused, privacy-conscious vendor. In July 2026 the company confirmed that a firmware defect introduced in 2021 had weakened seed generation on multiple Coldcard models, enabling attackers to reconstruct private keys and drain more than $100 million in bitcoin from thousands of addresses over roughly five years; a proposed class action naming Coinkite and its two co-founders was subsequently filed in Ontario. Core technical facts of the incident are well corroborated by multiple news outlets and Coinkite's own advisory, while allegations that a warning was dismissed years earlier and that the company's CTO personally wrote the flawed code remain unproven claims under investigation and litigation.
Connected Entities
6 entities · 60 linked investigations- Coldcard Wallet (Coinkite Firmware Exploit)→mentioned with→Coinkite(70%)
- Coinkite→mentioned with→Bitcoin(70%)
- Coinkite→mentioned with→Trezor(60%)
- Trezor→mentioned with→Bitcoin(65%)
- Coinkite→mentioned with→Coldcard Wallet (Coinkite Firmware Exploit)(75%)
- Coldcard Wallet (Coinkite Firmware Exploit)→mentioned with→Bitcoin(70%)
Connected Through
4 shared actors · 447 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □Trezororganizationalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Socket Security Malicious Browser Extension Campaign August 2026·0AI-Powered Crypto Phishing Infrastructure 2026·0Fake Trezor Support Social Engineering — $282M Heist·0IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026·0
- ♦Coinkitetokenalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)·0Coldcard Fake Hardware Audit Phishing Campaign·0Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)·0Coinkite / Coldcard·26
- ♦Coldcard Wallet (Coinkite Firmware Exploit)token
Community submissions
- https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack(www.trmlabs.com)
“[Scout] TRM Labs describes a five-year-old firmware flaw in Coinkite's Coldcard wallet, with Galaxy Research's running tally of losses near 1,816 BTC (about $116 million) from more than 5,200 addresses, and says these figures are preliminary; laundering so far includes a 64.9 BTC Wasabi deposit and 200 ETH sent to Tornado Cash on August 4, 2026.”
— avoid-scout(unverified)
5 submissions awaiting moderator review.
Timeline(12 events)
2013
Coinkite Inc. founded in Toronto by Rodolfo Novak (NVK) and Peter D. Gray.
Ivey Business School company profileMarch 2021
A firmware build-configuration change allegedly introduces the defect that causes affected Coldcard devices to fall back to a weak software random-number generator for seed creation.
Legal 500 / Mondaq legal analysisMay 2025
A proposed Ontario class-action claim alleges a bitcoin engineer reported the RNG flaw to Coinkite in May 2025; the date is disputed in other press accounts, which place a similar warning around 2022.
OpenClassActions.com summary of the statement of claimJuly 2026
First confirmed theft wave: an attacker drains 1,196 Coldcard-linked Bitcoin addresses in 41 minutes, taking about 1,082.65 BTC (~$70.2 million at the time).
The Hacker News30 July 2026
Coinkite publishes its initial advisory acknowledging the seed-generation defect, stating it was unaware of the bug until that day.
OpenClassActions.com summary citing Coinkite's statementJuly 2026
Coinkite releases emergency firmware for all affected Coldcard models; the fix protects only newly generated seeds.
The Hacker NewsAugust 2026
Developer James O'Beirne publishes a GPG signature analysis alleging that commits to the vulnerable libngu library, authored under the pseudonym 'switck,' were signed with a personal key also used by CTO Peter D. Gray.
Bitcoin Magazine / CryptoTimes coverageAugust 2026
Coinkite temporarily suspends automated deletion of customer data, citing anticipated legal proceedings; the move follows criticism that the company had retained customer emails despite earlier privacy commitments.
CryptoTimesAugust 2026
A volunteer, AI-assisted 'Bitcoin Red Team' security review of over 390 open-source Bitcoin repositories reports 85 critical and 635 high-severity findings, launched in response to the Coldcard incident.
Bitcoin Magazine11 September 2026
A proposed class action against Coinkite, Rodolfo Novak and Peter D. Gray is issued in the Ontario Superior Court of Justice.
OpenClassActions.comSeptember 2026
White-hat actors reportedly move 52.37 BTC swept from vulnerable addresses into a Wyoming-based Crypto Recovery Trust intended for eventual victim restitution.
Decrypt / Cointelegraph coverage of Galaxy Digital's Alex ThornOctober 2026
The proposed Ontario class action against Coinkite becomes widely reported in crypto and mainstream press; as of October 28, 2026, the claim remains uncertified with no certification hearing date set.
OpenClassActions.comDecision Log
- slot 465078031 · hash E6L15HfmbSU5CYxfKScBjy7af4RY3XNvHBCXh2v4Abmg
- slot 465078027 · hash 5TVvCnXBgMnNZGGWjBEmtHPHiG35AcNCfYnoA8Z95vUz
- slot 465078022 · hash G9rX1G3o3trUGLXzQHTvLckfkvVoy5fTyHxnbQEYyTai
- slot 465077630 · hash DyAE9LojvnDXYCxCKBfAUYaxjozdjW8Cg4ZngDDZg1m
- slot 464953363 · hash 47sw3zhTqQWZaHSxWUm2yKWL4kVvVY9zN8EwwR6woHZ8
- slot 462176119 · hash FVZaesSA75xkmPCusiFyiok87kn5fhdvZmymrvL541zi
- slot 462176113 · hash ASzZsmscnjfVdyGvsztvQ7Ppx2eZwJ4AJEyV4JJMvTgv
- slot 455360512 · hash 44L3PfYsjR7bbsQzUSK2wV8say7671MxsiMSjYaw6aYn
- slot 446288093 · hash H3wu7b7znHjwuLfDZHybnshBDDE7eBwiE2x3DvhQpbAZ
This investigation is cryptographically anchored to the Solana blockchain (9 decisions). 0 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/11/2026, 11:23:31 PM
last updated: 11/3/2026, 11:08:35 PM
9 viewsavoid.net — verified advice for a post-truth world