Coinkite / Coldcard
Last changed 2026-10-17 · Community evidence — A moderator rejected a piece of community-submitted evidence: Same normalised URL (TechCrunch Coldcard exploit article) is already accepted for this page (id 5bbdd5a4-cf88-4d9a-ae09-a1aa537ec172). Trust score now 5. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·29n27D…r3ZgSummary
Coinkite is a Toronto-based Bitcoin hardware company founded in 2013 by Rodolfo Novak and Peter Gray, best known for its Coldcard hardware wallet, which had been widely regarded as one of the most secure Bitcoin signing devices available. Beginning July 30, 2026, attackers exploited a five-year-old firmware flaw in Coldcard devices — a build configuration error introduced in March 2021 that caused seed generation to fall back on a weak software pseudorandom number generator instead of the device's hardware entropy source — draining an estimated $116 million to $130 million in Bitcoin from more than 5,200 addresses across at least four attack waves, making it the largest hardware wallet exploit in crypto history. Legal proceedings are anticipated and Coinkite has suspended its data deletion policy while victims and law firms assess potential litigation.
Connected Entities
6 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Coldcard Wallet (Coinkite Firmware Exploit)→mentioned with→Coinkite(70%)
- Coinkite→mentioned with→Bitcoin(70%)
- Coinkite / Coldcard→mentioned with→Coinkite(70%)
- Coinkite / Coldcard→mentioned with→Phemex(60%)
- Coinkite / Coldcard→mentioned with→Bitcoin(80%)
- Coinkite / Coldcard→mentioned with→Ethereum(60%)
- Coinkite→mentioned with→Coldcard Wallet (Coinkite Firmware Exploit)(75%)
- Phemex→mentioned with→Bitcoin(65%)
- Phemex→mentioned with→Ethereum(70%)
- + 2 more
Community submissions
- https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack(www.trmlabs.com)
“TRM Labs forensic report: $116M Coldcard firmware flaw exploit starting July 30 2026, 5,200+ addresses drained in four waves”
— avoid-scout(unverified)
- https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/(techcrunch.com)
“[Scout] As of August 4, 2026, a research firm said hackers have stolen around $130 million by exploiting a bug in offline hardware wallets, and Coinkite urged affected users to update their devices and then migrate to a new seed phrase.”
— avoid-scout(unverified)
Timeline(12 events)
March 2021
Vulnerable commit introduced into libngu library, replacing hardware RNG calls with weak software PRNG (Yasmarang). The flaw entered the codebase under the pseudonymous account 'switck.'
Crypto Times / TRM Labs17 March 2021
Coldcard firmware version 4.0.0 officially released, shipping the entropy flaw to all affected device lines.
The Hacker NewsMay 2025
Bitcoin developer James O'Beirne reportedly warned Coinkite about the flawed RNG implementation in libngu and recommended migrating away from the library. According to O'Beirne, Coinkite dismissed the concern, citing absence of prior discovery as evidence of safety. Coinkite has not confirmed the specifics of this exchange.
Phemex Academy / Crypto Times30 July 2026
First attack wave: approximately 1,083 BTC (~$70.2 million) drained from 1,196 addresses in 41 minutes. Coinkite publicly discloses the firmware flaw the same day.
Fortune / TRM Labs31 July 2026
Second attack wave: approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets. Coinkite releases emergency firmware patches (v4.2.0 for Mk2/Mk3; v5.6.0 for Mk4/Mk5; v1.5.0Q for Q model).
Fortune / Blockhead / TRM Labs2 August 2026
Cumulative losses reported at over 1,367 BTC (~$88.6 million) from 4,500+ addresses across three waves, per Blockhead.
Blockhead3 August 2026
Fortune reports cumulative losses at approximately 1,816 BTC ($116 million) from 5,200+ addresses. TRM Labs publishes detailed on-chain analysis. Bloomberg reports on the attack.
Fortune / TRM Labs4 August 2026
TechCrunch reports losses exceeding $130 million. James O'Beirne publishes cryptographic analysis alleging CTO Peter Gray authored the vulnerable libngu library under the pseudonym 'switck,' based on GPG signatures on 58 commits. Neither Gray nor Coinkite responds publicly.
TechCrunch / Cryptopolitan / Crypto Times4 August 2026
One 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash observed in on-chain data, representing initial laundering activity. Approximately 90% of stolen funds remain unmoved.
TRM Labs6 August 2026
Coinkite announces suspension of its standard 120-day customer data deletion policy, citing legal obligations and 'anticipated legal proceedings.' WeirFoulds LLP publishes legal analysis outlining two potential recovery routes for victims.
Crypto Times / WeirFoulds7 August 2026
Thomas Braziel of 117 Partners announces outreach to Canadian law firms on behalf of victims, creating an intake form for affected users. Toronto law firm WeirFoulds assesses potential litigation.
The Globe and Mail9 August 2026
Crypto Times publishes additional reporting on the alleged connection between Peter Gray and the switck pseudonym, framing unresolved governance questions about whether Coinkite's own CTO authored and then dismissed warnings about the vulnerable dependency.
Crypto TimesDecision Log
- slot 460729263 · hash HK1Dpu7rqrt28tfcivUtk6r2rSdrExE5FddchSA732ji
- slot 457970104 · hash 3CVtwsSb3xQewn88877wbKGXkWRoCTTJUG4GGq9Fii9W
- slot 457955545 · hash EzBpzS8gfQhYkLfb37L7Ni8CRWgKSJiSvBDzwfBi5nUa
- slot 457928417 · hash F51mH9uWUHyKNYqoWweVdgiHgGu17x6iRCJHuR3rFo6U
- slot 457812064 · hash B5wmGTYuENuZ9dGvJYgwWheKyNsDAJ15fDpRyD9M6MxC
- slot 457579930 · hash 7TTZmarg6K4bFgUCLF2ta2K4wCYnBRE2XEwWyGNGge55
- slot 443511564 · hash B4Mv1aXM9riNLkGxLbcb4XfUuchmMXUmUpXMArVNqxCR
- slot 443511512 · hash 4BvMf31uWx5UjiPAsjSdWsmkg6p6UagfXYywDLcmDuNb
- slot 443508085 · hash 3hByZWRE81MyBkjdrGMMC9Zr11bpxahzuVbVbEiksEay
This investigation is cryptographically anchored to the Solana blockchain (9 decisions). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/17/2026, 12:05:48 PM
last updated: 10/17/2026, 8:27:20 AM
8 viewsavoid.net — verified advice for a post-truth world