Coinkite / Coldcard
Summary
Coinkite is a Toronto-based Bitcoin hardware company founded in 2013 by Rodolfo Novak and Peter Gray, best known for its Coldcard hardware wallet, which had been widely regarded as one of the most secure Bitcoin signing devices available. Beginning July 30, 2026, attackers exploited a five-year-old firmware flaw in Coldcard devices — a build configuration error introduced in March 2021 that caused seed generation to fall back on a weak software pseudorandom number generator instead of the device's hardware entropy source — draining an estimated $116 million to $130 million in Bitcoin from more than 5,200 addresses across at least four attack waves, making it the largest hardware wallet exploit in crypto history. Legal proceedings are anticipated and Coinkite has suspended its data deletion policy while victims and law firms assess potential litigation.
Connected Entities
1 entities- + 1 more
Timeline(12 events)
2021-03-01
Vulnerable commit introduced into libngu library, replacing hardware RNG calls with weak software PRNG (Yasmarang). The flaw entered the codebase under the pseudonymous account 'switck.'
Crypto Times / TRM Labs2021-03-17
Coldcard firmware version 4.0.0 officially released, shipping the entropy flaw to all affected device lines.
The Hacker News2025-05-01
Bitcoin developer James O'Beirne reportedly warned Coinkite about the flawed RNG implementation in libngu and recommended migrating away from the library. According to O'Beirne, Coinkite dismissed the concern, citing absence of prior discovery as evidence of safety. Coinkite has not confirmed the specifics of this exchange.
Phemex Academy / Crypto Times2026-07-30
First attack wave: approximately 1,083 BTC (~$70.2 million) drained from 1,196 addresses in 41 minutes. Coinkite publicly discloses the firmware flaw the same day.
Fortune / TRM Labs2026-07-31
Second attack wave: approximately 594 BTC (~$38 million) drained in 25 minutes from ~500 wallets. Coinkite releases emergency firmware patches (v4.2.0 for Mk2/Mk3; v5.6.0 for Mk4/Mk5; v1.5.0Q for Q model).
Fortune / Blockhead / TRM Labs2026-08-02
Cumulative losses reported at over 1,367 BTC (~$88.6 million) from 4,500+ addresses across three waves, per Blockhead.
Blockhead2026-08-03
Fortune reports cumulative losses at approximately 1,816 BTC ($116 million) from 5,200+ addresses. TRM Labs publishes detailed on-chain analysis. Bloomberg reports on the attack.
Fortune / TRM Labs2026-08-04
TechCrunch reports losses exceeding $130 million. James O'Beirne publishes cryptographic analysis alleging CTO Peter Gray authored the vulnerable libngu library under the pseudonym 'switck,' based on GPG signatures on 58 commits. Neither Gray nor Coinkite responds publicly.
TechCrunch / Cryptopolitan / Crypto Times2026-08-04
One 64.9 BTC Wasabi deposit and 200 ETH bridged to Tornado Cash observed in on-chain data, representing initial laundering activity. Approximately 90% of stolen funds remain unmoved.
TRM Labs2026-08-06
Coinkite announces suspension of its standard 120-day customer data deletion policy, citing legal obligations and 'anticipated legal proceedings.' WeirFoulds LLP publishes legal analysis outlining two potential recovery routes for victims.
Crypto Times / WeirFoulds2026-08-07
Thomas Braziel of 117 Partners announces outreach to Canadian law firms on behalf of victims, creating an intake form for affected users. Toronto law firm WeirFoulds assesses potential litigation.
The Globe and Mail2026-08-09
Crypto Times publishes additional reporting on the alleged connection between Peter Gray and the switck pseudonym, framing unresolved governance questions about whether Coinkite's own CTO authored and then dismissed warnings about the vulnerable dependency.
Crypto TimesDecision Log
- #1publish⛓ pending8/17/2026, 12:05:58 PMhash: 3hByZWRE81MyBkjdrGMMC9Zr11bpxahzuVbVbEiksEay
18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/17/2026, 12:05:48 PM
last updated: 8/17/2026, 6:39:34 PM
avoid.net — verified advice for a post-truth world