coinkite

According to The Block, due to the wallet migration triggered by the Coldcard vulnerability, the number of new Bitcoin addresses surged from about 260,000 to over 330,000 last week, reversing the downward trend that persisted for most of 2026.Since July 30, Coinkite hardware wallet users have lost at least 1,816 BTC (approximately $116 million) in four waves of attacks. The vulnerability originated from a firmware defect in 2021—using a less secure software random number generator when generating mnemonic phrases instead of the device's built-in hardware entropy source, allowing attackers to brute-force wallets generated offline. Coinkite has advised users who generated wallets between March 2021 and the release of the security patch to migrate to new wallets.This incident highlights the risks associated with self-custody, as users are reassessing the pros and cons of self-custody versus custodial solutions like centralized exchanges or ETFs.

Bitcoin News posted on the X platform stating that Coinkite claims the vulnerability exists at the boundaries of two unrelated firmware submodules, rather than in its Bitcoin or crypto code, allowing it to evade manual and AI-assisted code reviews for years.Coinkite stated that after the incident, the company tested cutting-edge AI models including Kimi K3, Claude Fable, and Codex 5.6, none of which identified the flaw. Coinkite is currently urging security-critical projects to specifically audit build systems and submodule boundaries, warning that AI-assisted development may leave similar blind spots in the Bitcoin ecosystem.

Bitcoin News posted on the X platform that new evidence shows the anonymous switck account that wrote the LibNgU code may actually be Peter Gray, co-founder and CTO of Coinkite, as the code is at the core of the COLDCARD entropy failure incident.Researchers claim that Gray's GPG key signed dozens of switck submissions, and other identifiers seem to link the two identities. Bitcoin developer James O'Beirne stated that he warned Coinkite in May 2025 that the RNG implementation of LibNgU looked suspicious and suggested removing it, but he said the response was that any issues should have already been discovered. Screenshots also show that as early as April 2021, users had already questioned the rewrite of LibNgU.If these findings are accurate, it means that the engineer who introduced the code was later associated with the theft of over 1,800 BTC and had received direct warnings about the RNG implementation more than a year before the vulnerability was publicly disclosed.

Bitcoin hardware wallet manufacturer Coinkite disclosed in late July 2026 that a firmware build error introduced in March 2021 caused some Coldcard wallets to generate mnemonic phrases from a smaller range, reducing the randomness of user private keys. Galaxy Research researchers stated that the Coldcard vulnerability exploitation occurred in multiple rounds, with observed Bitcoin losses increasing from approximately $88 million to nearly $114 million within a few days.Researchers warned that other vulnerable addresses may still become targets, prompting many Coldcard users to transfer their Bitcoin. Coldcard is a wallet that only supports Bitcoin and allows for offline signing via microSD cards and optional QR codes. The wallet was launched in 2017 and has long been regarded as one of the Bitcoin hardware wallets focused on security.

Canadian hardware wallet manufacturer Coinkite has issued a security warning, advising users who generated mnemonic phrases with Coldcard Mk3 firmware versions 4.1 to 5.3 to migrate their assets as soon as possible. The company stated that preliminary analysis shows wallets using BIP-39 passphrases are at lower risk, and Mk4, Q, and Mk5 devices are not affected; the investigation is still ongoing.Meanwhile, security researchers are investigating an anomalous transfer event involving 594.48 BTC (approximately 38.3 million USD). AnchorWatch CEO Rob Hamilton stated that attackers transferred 1,324 UTXOs through 500 transactions within three blocks and speculated that the issue may stem from insufficient random number entropy during the wallet generation process. Wizardsardine CEO Kevin Loaec believes the vulnerability may be related to a specific software library, secure chip, or a particular batch of devices, as well as low-entropy random number generators in firmware versions, with attackers possibly using AI-generated scripts to brute-force the affected wallets. There is currently no conclusive evidence linking this fund transfer to a direct vulnerability in Coldcard Mk3.