Coldcard’s $116M exploit sparks fresh clash over NVK’s defense

50Importance
updatingStatus
2News media
Published
Updated

Coinkite CEO Rodolfo Novak, known as NVK, has defended Coldcard’s security review process after a reported seed-generation exploit tied to the hardware wallet. The dispute now centers on whether a new AI model found a flaw that human reviewers did not catch, alongside the reported scale of losses and affected Bitcoin addresses.

Key claims & sources

✓
Rodolfo Novak, Coinkite’s CEO known as NVK, defended Coldcard’s earlier security reviews and said a new artificial intelligence model found a flaw that human reviewers missed.
✓
The debate was reignited on Nov. 9, when NVK posted on X about the security review dispute tied to Coldcard’s seed-generation exploit.
✓
The Coldcard exploit was reported as having accumulated about $116 million in estimated losses and affecting more than 5,200 Bitcoin addresses between July and August 2026.
✓
The incident has been framed as a clash over whether Coldcard’s review process was sufficient after the exploit was linked to the hardware wallet’s seed-generation system.

What it means

Coldcard is a hardware wallet brand from Coinkite, and seed generation is one of the most sensitive parts of wallet security because it sits at the start of key creation. The Nov. 9 posts from NVK put the company’s review process back in the spotlight after a reported exploit tied to the device. That makes the case relevant not just to one product, but to how hardware-wallet makers explain their security checks when something goes wrong.

For users and builders, the immediate issue is trust in how private keys are generated and reviewed before devices reach customers. If a flaw can be described as something an AI model spotted after human reviewers missed it, then teams using similar review workflows will have to rethink what gets checked and by whom. The event also reminds wallet users that even products marketed around security can become the center of public disputes after an exploit. (per crypto-economy.com)

The deeper tension is between security claims that rely on human review and a market that is increasingly willing to treat AI as another layer of assurance. Hardware wallets are supposed to reduce reliance on software trust, yet this dispute shows that the real weak point can still be the design and audit process around the device itself. That leaves open the question of how much confidence users should place in review statements when a failure is later described in public.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The total crypto market rose 0.2% in the 4 hours after the first headline, after a flat 2 hours before.

$2.5T market cap at the headline
0.0% 2 h before
+0.2% 4 h after
-0.2% 6 h after (so far)
First headline

37 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 9 19:21
crypto.news scoop
Breaks the event: $116M
+5 h 28 m
Nov 10 00:48
Crypto Economy context
Its angle: cryptocurrency, approximately, communicated

Thefts of a similar size

WhenWhat happenedFigure
3 months ago COLDCARD · Weak Key Generation incident $116M
4.1 years ago Mango Markets V3 · Spot Price Manipulation incident $115M
3.0 years ago HTX & Heco incident $113.3M
4.4 years ago Elrond · Infinite Mint incident $113M
2.8 years ago Chris Larsen · Private key leakage incident $112.5M

4294 incidents stored · 70 were as large as this one or larger ($116M)