Coldcard Security Debate Grows After $116M BTC Wallet Hack

Coinkite CEO NVK defended Coldcard’s security checks on November 9. He said a new AI model found the flaw behind an estimated $116 million Bitcoin theft. Developer Luke Dashjr disputed the claim about what human reviewers could detect.

On X, NVK said Coldcard underwent at least two paid third-party reviews before the exploit. One covered the Mk4 in 2022, and another examined the Q in 2024. At least 15 documented external review or security-research efforts touched COLDCARD hardware, firmware, RNG-adjacent tools, or release controls before the defect was discovered.

A least 2 paid third-party product reviews were completed before the incident: a Mk4 review in 2022… — NVK (@nvk) November 9, 2026 NVK said Rob Ham conducted a separate review using the OpenAI Cybersecurity Harness. The review identified 85 potential issues and prompted several fix…