Back
Coldcard flaw drained about $90 million in Bitcoin from more than 4,500 addresses

Coldcard flaw drained about $90 million in Bitcoin from more than 4,500 addresses

Coinkite founder Rodolfo Novak apologized as victims were urged to preserve devices, protect remaining funds and file police and FBI complaints after the Coldcard firmware failure.

BTC

Fact Check
CoinDesk primary reporting confirms 594 BTC drained from ~500 Coldcard wallets via a seed-generation/randomness flaw. Cowen's own X post confirms his commentary about the losses. The spendnode blog confirms Coldcard destroyed vulnerable inventory and is working with law enforcement. The $50M figure is approximate and consistent with reporting, though CoinDesk cited ~$38M and another u.today piece $70M, reflecting differing BTC price references. The core claims are strongly corroborated.
Summary

More than 4,585 Bitcoin wallet owners are now being described as victims of Coinkite's Coldcard firmware failure, extending the fallout from a seed-generation bug that blockchain analysts previously linked to roughly 1,800 BTC, or nearly $90 million, drained from more than 5,200 potential victim addresses. The flaw dated to firmware shipped from March 2021 through late last week, when seed creation was routed through a deterministic pseudo-random number generator instead of the intended hardware entropy source, and the latest reporting says affected users include devices with and without passphrases. A white-hat effort to secure exposed wallets has begun, while founder Rodolfo Novak, known as "NVK," apologized and said Coinkite is "committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation." Users are being urged to preserve affected devices, move remaining funds to wallets created from new seed phrases, and document losses for local police, the FBI's IC3 complaint system and, where appropriate, insurance, civil, tax and consumer-fraud filings, while ignoring unsolicited approaches from supposed investigators or lawyers.

Terms & Concepts
  • seed phrases: Recovery words that let a user restore access to a crypto wallet.
  • pseudo-random number generator: Software that produces values algorithmically rather than from physical randomness, which can weaken wallet creation if used improperly.
  • white-hat: A security actor trying to protect users or systems rather than exploit them for personal gain.