Coldcard’s $116M exploit sparks fresh clash over NVK’s defense
- Published
- Updated
Coinkite CEO Rodolfo Novak, known as NVK, has defended Coldcard’s security review process after a reported seed-generation exploit tied to the hardware wallet. The dispute now centers on whether a new AI model found a flaw that human reviewers did not catch, alongside the reported scale of losses and affected Bitcoin addresses.
Key claims & sources
What it means
Coldcard is a hardware wallet brand from Coinkite, and seed generation is one of the most sensitive parts of wallet security because it sits at the start of key creation. The Nov. 9 posts from NVK put the company’s review process back in the spotlight after a reported exploit tied to the device. That makes the case relevant not just to one product, but to how hardware-wallet makers explain their security checks when something goes wrong.
For users and builders, the immediate issue is trust in how private keys are generated and reviewed before devices reach customers. If a flaw can be described as something an AI model spotted after human reviewers missed it, then teams using similar review workflows will have to rethink what gets checked and by whom. The event also reminds wallet users that even products marketed around security can become the center of public disputes after an exploit. (per crypto-economy.com)
The deeper tension is between security claims that rely on human review and a market that is increasingly willing to treat AI as another layer of assurance. Hardware wallets are supposed to reduce reliance on software trust, yet this dispute shows that the real weak point can still be the design and audit process around the device itself. That leaves open the question of how much confidence users should place in review statements when a failure is later described in public.
Market reaction i
The total crypto market rose 0.2% in the 4 hours after the first headline, after a flat 2 hours before.
37 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 3 months ago | COLDCARD · Weak Key Generation incident | $116M |
| 4.1 years ago | Mango Markets V3 · Spot Price Manipulation incident | $115M |
| 3.0 years ago | HTX & Heco incident | $113.3M |
| 4.4 years ago | Elrond · Infinite Mint incident | $113M |
| 2.8 years ago | Chris Larsen · Private key leakage incident | $112.5M |
4294 incidents stored · 70 were as large as this one or larger ($116M)