Coinkite's Chief Executive Defends Coldcard Reviews and Says an AI Model Found the Seed Flaw Humans Missed

Rodolfo Novak, the chief executive of Coldcard maker Coinkite who posts as NVK, defended the company's security reviews on X on November 9. He argued that a new artificial intelligence (AI) model found a defect that human reviewers had missed. crypto.news puts losses from the Coldcard seed-generation exploit at $116 million. Other trackers count the theft in bitcoin, and an editor's note cited by Bitcoin.com News puts it above 2,000 BTC.

The root cause was a flaw in the randomness used to generate keys (entropy), introduced at build time. Analyses compiled by Rekt News and Forklog describe a configuration setting that was present but assigned a value of zero. The firmware still compiled, but seed generation fell back to a weaker software random-number generator, with no warning to the user. Seeds produced that way could be reconstructed. The attacker began draining hundreds of addresses on July 30. Accounts of the affected firmware versions differ, but reports center on Mk2 and Mk3 devices. Hours before the advisory, NVK said there was "no evidence of a flaw." He apologized on July 31 and accepted responsibility for the firmware failure. Users whose Coldcard key was only one signer in a multisignature setup kept their funds.

The second development involves institutional custody rather than self-custody. Robbie Mitchnick, who leads digital assets at BlackRock, told Barron's that demand to exchange directly held bitcoin for IBIT shares is at its highest yet. He said "security and peace of mind" is the top reason, as kidnappings and hacks increase. BlackRock sells the product that benefits from that shift, so its account is not neutral. It is still consistent with the timing of the Coldcard losses and the rise in physical attacks on holders.

NVK's claim implies a further risk. If AI models can find flaws that human reviewers miss, they will keep finding them in firmware already installed on customers' devices. A software patch cannot repair a seed that was generated with weak entropy. The only fix is to generate a new seed and move the funds to it.