Coinkite CEO Ties Coldcard Flaw to About 1,816 BTC in Losses

Coinkite CEO Rodolfo Novak said a flaw in Coldcard firmware led to about 1,816 Bitcoin (BTC) in losses across more than 5,200 addresses, leaving affected users needing new seed phrases.

The vulnerability affects firmware version 4.1 and later and can bypass the hardware random-number generator, Novak said. He placed the losses between July 30 and Aug. 4, valuing them at about $116 million.

Novak said a new AI model found the flaw after at least 15 reviews had failed to catch it. Bitcoin developers disputed the claim that the model found a bug human reviewers missed. James O'Beirne, a Bitcoin developer, said he privately raised concerns about Coldcard's random-number generation in May 2025.

A firmware update can address the issue on new devices, Novak said, but it cannot repair seed phrases already created. Affected users need to generate new seed phrases; the firmware change does not alter phrases already in use.