Coinkite’s CEO NVK has reopened a heated debate over the company’s security posture after defending the firm’s pre-exploit reviews and saying a new AI model found a seed-generation flaw human auditors missed. What NVK says - On Nov. 9 NVK posted on X that Coinkite’s security work included hardware and firmware reviews, tools connected to random-number generation (RNG), and release controls. He cited at least two paid third‑party product reviews (an Mk4 review in 2022 and a Q review in 2024) and said at least 15 documented external reviews or research efforts had examined Coldcard components touching RNG or release processes prior to the exploit. - NVK also said Rob Ham’s OpenAI Cybersecurity Harness review produced 85 candidate findings before the incident and that several prompted fixes — but that the seed-generation defect was not among them. “The uncomfortable truth is that it took a new AI model to find what humans couldn’t,” he wrote. Pushback from the Bitcoin community - Bitcoin developer Luke Dashjr pushed back, saying he had privately alerted Coinkite to issues and was now publicly disclosing them. Dashjr stressed he wasn’t claiming every flagged item was a bug or exploitable, and that his review was a quick look rather than a full audit. - Dashjr specifically disputed NVK’s implication that only an advanced AI could have found the RNG problem. - Other community members questioned Coinkite’s handling of outside scrutiny. Alex Waltz accused the company of discouraging code inspection; another commenter argued that ad-hoc full-code reviews are different from continuous QA and easier to miss “a needle in a haystack” without embedded testing. - Defenders of NVK noted that reviewers had inspected the entropy system previously without reproducing the failure, and challenged critics to produce a reproducible bug report rather than private messages. Earlier warnings and investigations - Posts by James O’Beirne resurfaced in the discussion. O’Beirne said he began examining Coldcard firmware in May 2025 to trace entropy sources, raised concerns about the libngu library and hardcoded software-fallback constants, and suggested linking directly against libsecp256k1. He said he didn’t pursue the matter rigorously and later received a separate credible report that someone had warned Coinkite about entropy issues back in 2021 — meaning there may have been multiple prior warnings the company received. - TRM Labs’ Aug. 5 analysis (cited by Galaxy Research) estimated roughly 1,816 BTC stolen from more than 5,200 addresses across four waves beginning July 30. The vulnerability traces to a March 2021 build-configuration error that selected a weak software RNG; on some older devices, effective seed strength fell to about 40 bits from an intended 128, enabling attackers to reconstruct keys without physical access. - Follow-on fund movements were reported in September. Galaxy Research’s Alex Thorn tracked a third-wave attacker swapping roughly 10% of that attacker’s Bitcoin through THORChain into Ether. Thorn also said the attacker’s identity “may be known to law enforcement,” though no confirmed FBI identification or recovery was reported. Coinkite’s response and guidance - Coinkite’s security page frames the published record as a living postmortem and notes a detailed technical report is still in preparation. The page distinguishes targeted independent checks from a full audit of every corrected firmware binary, and lists work such as hardware randomness testing, source reviews, and a reproducible build process. - Current recommended releases are 5.6.3 for Mk4/Mk5 and 1.5.3Q for Q. The advisory warns that firmware updates cannot repair already affected seeds. Its migration steps: generate a new seed, create a verified backup and receiving address, send a small test transfer, then move the remaining funds. Why it matters - The episode highlights tensions between traditional human audits, continuous QA practices, and emerging automated tooling — including AI-assisted audits — in securing hardware wallets. It also underscores the long tail of configuration and supply-chain mistakes: a small build-time error from 2021 reportedly produced a weakness exploited years later, costing users significant funds. What to watch next - The community is awaiting Coinkite’s detailed technical report and any further forensic updates from law enforcement or analytics firms. Meanwhile, affected users are being urged to follow the migration guidance — generate new seeds and move funds — because firmware updates alone won’t salvage compromised seeds. Read more AI-generated news on: https://app.chaingpt.org/news