Coldcard’s $116M exploit sparks fresh clash over NVK’s defense

Coinkite CEO NVK has reignited debate over Coldcard’s $116 million seed-generation exploit by defending its security reviews and arguing that a new AI model found a defect human reviewers missed. NVK says at least 15 external reviews or research efforts touched Coldcard before the defect emerged. Luke Dashjr disputes claims that human reviewers could not identify problems with the random-number generator. James O’Beirne says he raised concerns about Coldcard’s randomness implementation in May 2025. Coinkite’s current security record says a separate detailed technical postmortem remains in preparation. NVK, posting on X on Nov. 9, said the work included reviews of Coldcard hardware, firmware, tools connected to random-number generation, and release controls. He cited two paid third-party product reviews: one covering Mk4 in 2022 and another covering Q in 2024.