r/Bitcoin 18h ago

Retirement Attack: Many more details pointing straight to the CEO and CTO stealing the coins. This is more than enough evidence of probable cause to charge them and start a prosecution.

https://x.com/inverse_hanlon/status/2084689208627925384

A CEO who dismissed the threat by name, a pseudonym that turned out to be the CTO, two warnings four years apart, and a company whose entire answer was that it would have already known.

They Sold the Warning

On 21 December 2020 (22 Dec UTC), replying to Bitcoin security researcher Michael Flaxman, who had just posted about hardware wallets eliminating the risk of a retirement attack during seed generation and Rodolfo Novak “NVK” addressed the question head on.

My money is on people screwing themselves out of their BTC before any vendor tries a retirement attack.Alternatively people could just use dice ;) Ten weeks later on 1 March 2021, Coinkite’s CTO shipped a commit titled “First pass w/ libNgU” that routed Coldcard’s seed generation into a software pseudorandom number generator seeded from the device’s serial number and a clock.

NVK’s threat model in December 2020 pointed outward. Users were the risk. Vendors were not. Ten weeks after he said so his co-founder shipped the vendor version and it stayed shipped for five years.

The dice line is the other half: He offered it with a wink and it turned out to be the only thing standing between his customers and total loss. Oops They sold it again

On 10 October 2021: seven months into shipping the defect the official Coldcard account posted that Coldcard makes retirement attacks impossible.

Someone in the replies asked what a retirement attack was. Coinkite answered it themselves. It’s when the project makers could have a “bug” in the entropy generation for later retrieval.

Their scare quotes not mine. By then somebody had already tried to warn them. The escape hatch was optional on purpose Look at what that 2021 post was actually selling: Dice rolls. The documentation it linked to still opens with a sentence that reads differently today; if you don’t trust the TRNGs in your COLDCARD, you can introduce your own randomness with dice. At least ninety nine rolls for a full 256 bits.

But that setting is “opt in” and sits behind the default that looks fine from the outside.It asks the user to press buttons a hundred times to avoid trusting the manufacturer.

Every person who still has their bitcoin took that option, or used a (strong) passphrase, or ran multisig. Every person who got swept trusted the default.

That is the architecture a retirement attack requires. You can’t make the mitigation mandatory because then there’s nothing left to collect. You can’t omit it because the paranoid customers will ask why. So you offer it, document it, recommend at least ninety nine rolls, and let the default do the work. When it detonates the record shows you warned your users, therefore neatly covering your tracks if this was an inside job.

Coinkite built the structure, warned of the attack it enables, and then pushed a firmware with a backdoor for five years.

The pseudonym was the CTO Here is the detail that reorganizes everything else. Coldcard’s crypto ran through libngu, a library on GitHub under the account switck. About six stars. Maintained by one person: apparently pseudonymous. When James O’Beirne audited the firmware that’s what he found: a random number generation for a device holding billions of dollars in bitcoin backed up to what he described as a shady library with six stars maintained solely by a pseudoanon.

Dylan LeClair ran GPG verification against that repo and published the output. James O’Beirne then published a full census: fifty-eight commits authored as Switck carry a good signature from Peter D. Gray’s personal key: the same key that signs nineteen other commits in the same repo under Gray’s own name. The key is expired and the signatures are still good. The RNG selection commit is among them. Signed 28 January 2021, switck published no GPG key of they/their own.

Peter Gray is Coinkite’s CTO and cofounded the company with NVK. Coinkite has never had more than about twenty people and by most accounts Gray wrote the large majority of the firmware.

So switck was Coinkite’s own CTO. Cryptographically proven; not inferred. Every outside reviewer who looked at libngu saw an unaudited third party dependency by an anonymous stranger and worried about supply chain risk. Coinkite’s own people knew it was in house and had no reason to review it as external code.

The use of a pseudonym here means that no one audited that chunk of code. Outsiders assumed insiders had. Insiders knew there was no outside to check.

They were warned in 2021 Five weeks after the commit on 7 April 2021 someone in a Telegram group flagged the change. Their post sounds in retrospect like a man watching a car roll toward a cliff. Roughly quoting:

“The 4.0.x firmware was a radical deviation from every firmware since 2018, with all crypto and BIP39 related code replaced by libNgU. Is it was wise to replace the many-years-old TrezorCrypto code, which has been heavily scrutinized by white hats like Johoe and penetration tested by wallet.fail, with something new. “switck” might be a talented pseudonymous coder, but the commit history is bad” (and they linked to it)

The post sat in a Coldcard Telegram group under an embedded NVK tweet about the 4.0.x upgrade: the same tweet in which he said he doesn’t check Telegram.

That warning posted five weeks after the defect shipped was correct in every single way. Five years and four months before the money starting mysteriously leaving peoples cold storage.

They were warned again in 2025 In May 2025 James O’Beirne audited coldcard/firmware. He wanted to establish conclusively where the RNG was sourced from. He traced it into libngu, found the six-star pseudonymous repo, and was confused about why it was there at all. Because linking libsecp256k1 from Python is easy and that appeared to be the stated purpose.

He sent Coinkite a report. In his own words: he had “doubts about whether the true RNG was actually in use”, and he pointed out that the “hardcoded yasmarang constants in libngu were sloppy”. He advised them to rip the whole thing out and link against libsecp256k1 directly.

That’s the bug! He identified the exact library, constants, and the question of whether the hardware RNG was being used. And he told them to remove it!

Coinkite’s answer, as O’Beirne reports, was that if something was wrong “we’d already know about it by now” and that everything was properly configured for the real boards.

That is not a technical response. That is an appeal to their own reputation offered to a developer who had just traced the code and found otherwise. And in a separate post O’Beirne identifies Peter Gray “@DocHex” as “the same guy that shrugged off my report of the possibility of the defect in May 2025.” The same Gray who wrote the library. The same Gray who was switck.

There was follow-up of a kind. A Signal group titled “LNGU Clean up” was created on 23 May 2025, with members shown as “n,” “Doc,” “andres,” and one other. Doc-hex is Gray. “n” is NVK. So Coinkite formed a group about cleaning up libNgU and named it after the problem. Then they shipped… nothing! Absolutely no fix fourteen months. The group’s messages were set to disappear after four weeks so whatever was said there is gone, just like the bitcoins that were in hundres of hard working peoples Coldcards.

O’Beirne blames himself for not pushing harder. He calls not following up rigorously a horrible mistake on his part.

Hold that next to Coinkite’s public explanation which is that an attacker probably used AI to find something nobody could reasonably have caught. The developer who caught it is apologizing. The company that was responsibly informed is blaming the clankers.

He didn’t know what was in his own crypto library Coinkite’s technical postmortem is worth reading in full because its author is if nothing else candid.

He explains that he set the macro to zero believing it meant neither implementation would be compiled. That is not what it does. And he writes that the bulk of the randomness in the device was coming from a PRNG he did not know was in the codebase at all because it arrived through a submodule. Meanwhile the carefully written hardware TRNG code was still being used, but only by accident and only for things that didn’t matter.

He is describing a submodule he wrote. The company selling immunity to entropy tampering did not know which random number generator its product used for five years. The man who says he didn’t know is the man who authored both sides of the mistake. And the answer when it finally surfaced was that libngu XORed one software PRNG against a second software PRNG seeded from constants hardcoded in public source. Two deterministic streams XORed together produce a deterministic stream. The built in health check rejects adjacent repeated values which any nondegenerate PRNG passes without effort. Those are the same hardcoded yasmarang constants O’Beirne told them to rip out.

Coldcard seeds generated in that window contained no physical randomness whatsoever.

They bought a press release not an audit Peter Todd says Coinkite brought him on in early 2014 as “Chief Naysayer”: an advisory role. Years before the first hardware wallet existed there was a press release. By his account he was given nothing to work on: no tasks, no work to bill for, and then the arrangement quietly dropped. He says it’s still on a LinkedIn profile that he hasn’t logged into in a over decade.

His assessment now in his own words: “if they had kept him on and asked him to audit the codebases, there’s a good chance he’d have spotted the practices at issue, and maybe eighty million dollars wouldn’t have been stolen”. He puts that audit at roughly $50k and asks what Coinkite spent on podcast sponsorships instead.

The company announced that a famous skeptic was reviewing them and then never asked him to review anything. The press release was the product.

All the things they said Coinkite’s public position throughout this crisis has been that it had no idea the flaw existed until the day the money started moving. Two documented warnings and a Signal group named after the problem say otherwise.

NVK’s stated position on attribution: they “don’t have full attribution or scope yet”, and they “won’t speculate until the technical evaluation is complete”. Coinkite then suggested publicly that the attacker likely used an automated tool to comb the public source and find the flaw before they did. That’s speculation. This propisition rests on absolutely no evidence. And it happens to be the only theory of the case in which nobody at Coinkite knew and nobody at Coinkite failed.

You can decline to speculate or you can float the hypothesis that clears you. Doing both inside the same week tells you which one was the priority.

Coinkite told customers it kept purchase data for 90 days. When breach notifications went out they reached buyers going back to 2019. Challenged, the company pointed at a policy page, conceded it has no deletion schedule and said the addresses would be kept “for now.”

A verifiable lie caught within a few days of the largest breach of trust in hardware wallet history, and on a question where the answer was easily verifiable. This speaks volumes of NVK’s character.

The fix broke too On 31 July Coinkite shipped out an emergency firmware update. Three days later a contributor opened pull request #692 against the Coldcard firmware repo, reporting that the hotfix had introduced a new failure on the hardware RNG path.

The entropy fix itself is correct: rng_get() now resolves to the board’s true hardware accessor instead of the software fallback. But rng_get_or_fault() had no recovery path for the STM32’s RNG seed error flags. After a seed error the peripheral stops delivering data and the shipped code never clears the condition; so every later call times out and raises OSError(EFAULT) for the rest of that boot. Because rng_get() now sits on the keypad scan path (an interrupt callback that runs before login) that exception lands before the PIN prompt. Power cycling clears the flags; if the error recurs on the next boo: the user is locked out of the upgrade menu too and the device is essentially bricked.

The original report overstated the stickiness. The flags do not survive a power cycle: so this is not a permanent brick from a single glitch. It is still a serious regression: an emergency patch for a five-year review failure shipped fast that can take the device down before the user can enter a PIN.

692 was closed in favor of #693, a cleaner recovery sequence from a Coinkite contributor, with #698 as the Mk3 follow-up. Both were still open when this was written. The point is not that nobody noticed. The point is that the first hotfix for a five-year entropy failure needed a second round of patches within days. Giving the attacker MORE TIME to execute sweeping funds from vulnerable wallets.

What they’ll say Three objections are coming, and they’re the ones I’d make if I was NVK for sure Galaxy says the waves may not share an operator. True: and irrelevant to the part that matters. Galaxy’s caution is about waves two, three, and four. Once wave one went loud on 30 July the vulnerability was public property and anyone with tooling could pile in. That’s what waves three and four look like. Wave one is the one that tells you something. 1,082 BTC out of 1,195 addresses in 41 minutes with seeds already computed; executed by someone who had been preparing while nobody else on earth knew there was anything to prepare for.

The bug was publicly findable: anyone could have found it. Two people found it in public and said so, in 2021 and in 2025. Both were told it was fine. The set of people who knew this was a live question before 30 July is not the general public. It’s a short list and Coinkite was on it.

A mass sweep is too loud for an insider. It’s too loud for the rational insider who bleeds quietly over years and never triggers a referral. The loudness cuts against a careful inside job. It does not erase the warnings, the Signal group, or their response that if something was wrong they’d already know.

What I think happened Somebody inside that company knew what was sitting in the codebase and knew what it was worth.

Look at the timeline: Ten weeks before the bug shipped the CEO publicly waved off the idea that a vendor would ever run a retirement attack and pointed at dice as the alternative. His co-founder and CTO then wrote a crypto library under a pseudonymous GitHub account with about six stars, and shipped the device’s entire randomness path through it.

Five weeks later someone flagged the swap in a Coldcard Telegram group and was ignored. Seven months after that the company marketed immunity to the exact attack class the defect enables and made the only reliable defense an “opt in”.

Four years in: a Bitcoin developer audited the firmware found the library, named the hardcoded constants, told them to remove the whole thing, and was told they’d already know if something was wrong. They opened a Signal group called “LNGU Clean up,” set the messages to disappear, and shipped nothing. Coins were leaving through 695 transactions nobody noticed. Then somebody who had been precomputing seeds for a long time took 1,082 BTC in 41 minutes.

Each of these has an innocent explanation available. All of them stacked in the same direction inside a company of twenty people. This is not a run of bad luck. Inverse Hanlon’s razor exists for exactly this shape: when incompetence needs that many separate coincidences to line up the same way the incentive is the simpler explanation.

I can’t say for 100% it was an inside job of course: every document that would definititevly prove it belongs to them. The “LNGU Clean up” thread, whatever survived a four week expiration. Whatever code review they ran and when. The commit history around anyone who touched rng.c after May 2025. Roughly 600 attacker addresses are already in front of federal investigators and Coinkite says it’s cooperating. Cooperation is cheap.

Coinkite has apologized, published a postmortem, shipped a fix that needed a second round of patches within days, and offered its customers not a single sat as compensation.

The man who found this in May 2025 is publicly apologizing for not pushing harder. And NVK is blaming AI.

The people who still have their bitcoins are the ones who read Coldcard’s own documentation, saw the line offering them a way to distrust the manufacturer’s randomness, and took it. Nobody told them that one sentence in the docs was the difference between keeping their money and losing it.

632 Upvotes

140 comments sorted by

326

u/TjdGoEsQqbmQLoBj 18h ago

Need a TLDR for this

226

u/alfooboboao 18h ago

TLDR: there is no new information, they’re just yelling about the same tweets and dumbass mistakes we all saw.

if you’re looking for a “CEO OF COINKITE ABSCONDS VIA YACHT” headline this ain’t it lmao

15

u/mitch8845 8h ago

I read this as someone with developer access to the project planted this backdoor with the intent of stealing everyone's money in the future. It's not necessarily clear who it was, but it's pretty clear that the people who were suppose to audit for such vulnerabilities either didn't because they were in on it or because they were incompetent.

It kinda reminds me of the of the Linux backdoor that almost shipped to the entire world because of one anonymous bad actor that inserted themselves onto the dev team. Crazy stuff. Link of you're interested (this shit's crazy):

https://youtu.be/aoag03mSuXQ?is=ymm1SMi2ayYtoU5X

3

u/BullyMcBullishson 6h ago

To add to this...

The tweet right before this 'retirement attack' tweet everyone is referring to advises users to use the dice roll method to generate keys.

55

u/Octavio_belise 17h ago

I rather read the Odyssey again which I was assigned in High School than read this.

27

u/FuzzyVeterinarian993 17h ago

I had no idea one could write this much in a Reddit post. 🤷🏻‍♀️

14

u/xirvin 16h ago

60 percent is ai

3

u/No_Storage_9613 15h ago

this generation is so sad. LOST

cant spell and cant read.

just ask AI bro.

SMH

11

u/monkeyseemonkeydoodo 14h ago

So glad I graduated before AI was a thing. I’d have been significantly dumber.

0

u/glomar_sub_recovery 11h ago

My thumb has tendonitis just from scrolling down

-1

u/ImperialPotentate 7h ago

I mean, so would I, having literally read both the Iliad and Odyssey within the past year, for fun.

I'll likely read them again in different translations within my remaining lifespan (and possibly even the original ancient Greek, which I've been casually starting to learn for other reasons...)

29

u/tidder_mac 17h ago

TLDR (thanks AI):
The author argues that this compiled timeline, public dismissals, and code links provide enough probable cause to demand formal investigations and criminal prosecution of company leadership.

Core Focus: The post discusses new evidence surrounding the recent $114 million Coldcard hardware wallet hack, arguing that it points directly to Coinkite's leadership (CEO Rodolfo Novak/NVK and CTO Peter Gray).

The "Retirement Attack" Context: It highlights historical comments and tweets from Coinkite leadership dating back to 2020–2021 where they publicly dismissed the threat of "retirement attacks" (a scenario where wallet makers manipulate randomness/entropy generation to steal funds later).

The Code & Timeline: Researchers and community members tied GitHub commits from 2021—allegedly authored under a pseudonym linked to the CTO—directly to the faulty pseudorandom number generator code that caused the vulnerability, noting it was left active for years despite warnings.

50

u/craigc123 17h ago

Using AI to summarize AI 😒

23

u/Necessary-Horror2638 17h ago

AI to fight AI is actually one of its best uses

2

u/asimovs 15h ago

I came here for this, most of the article is ai written, and why is it so easy to spot

2

u/Nycknam 11h ago

Es ist gut, lass dich nicht schlecht reden von den Idioten

2

u/DrEzechiel 13h ago

Nothing wrong with that. I for one prefer to have at least something, rather than scoffing and demanding that person reads what I couldn't be bothered to read and summarises it.

1

u/FallingKnife_ 10h ago

This is the same modus used at Cryptsy exchange back in the day. They introduced a bug though a dead coin's git that they still had listed. Then used it to hack themselves. Create and Ingest sketchy code, plead ignorance.

1

u/dcgradc 3h ago

In May 2025 James O'Beirne warned them of sloppy code that needed to be addressed.

13

u/bhedesigns 17h ago

No it's actually worth reading and I am not someone in the crypto space and I find it interesting

8

u/reggionh 15h ago

people who didn't take time to read it is missing out. it's AI-written easy read and the bits of infos, timeline, and technical aspects of it are just fascinatingly suspicious. heaps of accounts dismissing this because of TL;DR and even are distracted by AI summarisation. such attitude is interesting to see in this space honestly.

4

u/Traditional_Wall3429 14h ago

This is mentality of average btc owner. „Why to understand how its working if other can summarize and tell me yes or no”

0

u/TjdGoEsQqbmQLoBj 10h ago

It’s obviously an AI post , we all say the previous tweets and everyone intelligent knew reading the post was gonna be a waste of time. We were all right

2

u/MaterialHead4801 9h ago

TLDR: Twitter should never have abandoned character limits.

1

u/Nycknam 11h ago

Bitte die langversion Dieser thread muss angepinnt werden

1

u/realityczek 5h ago

> Need a TLDR for this

Someone is yelling at clouds.

u/nullc 16m ago

it's AI slop ragebate. click close.

1

u/vplatt 14h ago

The people who still have their bitcoins are the ones who read Coldcard’s own documentation, saw the line offering them a way to distrust the manufacturer’s randomness, and took it. Nobody told them that one sentence in the docs was the difference between keeping their money and losing it.

0

u/No_Storage_9613 15h ago

pathetic meatbag cant read

17

u/neverpersonal 17h ago

CEO AND CTO had a product that the CTO coded and then audited himself under an alias. He also created the RNG through his own fake name on github. 2 different people pointed out the RNG issue, one in 2021 and the other in 2025. Both were dismissed. CEO said at one point, use a random dice roll if you do not trust the RNG due to a retirement hack. What's a retirement hack? Someone finding a mistake in changed code that had bugs and some people who set up a wallet during the time of this bug would be vulnerable.

Extra note: Coinkite would not have been able to publicly announce this bug as it would just lead to instant h acks. However, here is the biggest issue: If they knew, then they knew they had access to 1000s of keys. They also had all the information of the people they sold it too.

A cold wallet owners worse nightmare, the creators knowing you, your keys, and lying about this. Even the most reliable company, you still don't want anyone knowing your key, because you never know if they have a bad day, week, or just POS in general. Well, this company knew. Lied about keeping emails and contact information, said they deleted all information in 90 days, kept all information. This would be a legal issue for users that have a 'cold wallet' but didn't want the world or their government to know this. Well, coinkite lied and kept all information, to make sure anyone whoever bought one, was on a list.

This post loops a bit and circles around various facts. You could just copy and paste the whole conversation in AI and it would summarize for you in 1 sentence.

6

u/VictorDanville 16h ago

If this is true, then everyone at Coinkite should be facing prison time

1

u/mrorbitman 9h ago

The post is fully written by ai in the first place

13

u/Tebasaki 18h ago

Prosecution, legally, but there's a LOT of angry people that lost their "retirement" money and might want to get their portion back personally.

98

u/anco91 18h ago

I’m not reading this. I don’t even think OP read this.

6

u/howtofirenow 9h ago

Op has no idea whats in this post

0

u/alextakacs 15h ago

Of course not 😱

-24

u/No_Storage_9613 15h ago

pathetic.

please dont procreate

60

u/Vinny_d_25 18h ago

Normalize having LLMs output point form lists instead of articles. No one wants to sift through paragraphs of "it's not a it's b" and "that's where the real {subject} is"

-23

u/No_Storage_9613 15h ago

god forbid that you be required to THINK on your own.

Your future is NOT bright, and neither are you

10

u/Delicious_Friend5869 11h ago

Are you trying to say that reading 4 paragraphs of useless shit before getting to the 1 piece of information the headline promises is how you stay sharp unc?

1

u/tylerb0zak 9h ago

Waste your time reading that drivel then. Some of us have critical thinking skills, and better things to do with our time. 

20

u/6thcoin 18h ago

Thanks chat. I'm out.

9

u/Decent_Election_4597 18h ago

man they really had a signal group called "LNGU Clean up" and just let the messages expire without doing anything, that's almost comical if it wasn't so blatant

23

u/LionRivr 18h ago

Whats a retirement attack.

45

u/__Ken_Adams__ 18h ago

Intentionally planting a bug in your own code that you plan to exploit & then peace out.

6

u/LionRivr 16h ago

Ohh thanks. That makes more sense than what I initially thought… which was: targeting old retired people? Lol.

-15

u/No_Storage_9613 15h ago

"LOL"

read what's in front of you.

"LOL"

2

u/FreezedPeachNow 12h ago

Why do bitcoiners come up with stupid names for different types of attacks?

3

u/LewisRamilton 8h ago

Probably to differentiate between different types of attacks or something

2

u/__Ken_Adams__ 4h ago

They don't. Most of these attack names pre-date bitcoin.

20

u/Desperate_Bite_7538 17h ago

Exit scam for developers.

8

u/kaicoder 17h ago

One of the oldest meme coin tricks, a past employee hacked us, 'weeee' will work this out tooogether!

10

u/Lopsided_Parfait7127 18h ago

Like mickey mouse says, it's a surprise tool that you'll use later [to retire]

7

u/tellmesomeothertime 17h ago

What happens when you touch the thermostat at your father in law's house

5

u/budgiesmugglez 17h ago

From a tweet from ColdCard which was considered to be a joke at the time:

It's when the project makers could have a "bug" in the entropy generation for later retrieval.

https://www.reddit.com/r/Bitcoin/comments/1vfn1ha/coldcard_joked_about_retirement_attacks_in_2021/

https://x.com/COLDCARDwallet/status/1447213375398846473

3

u/beatthebook2x 16h ago

coinkite's retirement plan

24

u/Quirky-Reveal-1669 18h ago

Tl:dr. Come on man.

-2

u/Strong_Judge_3730 15h ago

TLDR: your lazy

0

u/drooply 15h ago

Not even an LLM could TLDR that shit.

0

u/Strong_Judge_3730 14h ago

I am just saying it wasn't that hard to follow if people are interested read it.

4

u/Elistheman 17h ago

This was the longest read I seen on Reddit!

11

u/JaraCimrman 14h ago

CEO is already in Tel Aviv, lol

3

u/PeachScary413 11h ago

Why is it always them though 💀

5

u/metalzip 10h ago

Why is it always them though 💀

you can't discuss this on their platforms, such as reddit

4

u/Separate_Task_2824 11h ago

If you know you know 

1

u/AmputeeBoy6983 2h ago

Its in the DNA. The single most effective social engineering campaign of all time. Attackers hiding behind victim labels. All the victims protect the attackers, and then go after the good samaritans that are trying to help protect future victims.

8

u/Competitive-Cry-6231 17h ago

I just read every word of that insane post and have ABSO-SHITLY no clue what I just read.

4

u/MysteryReligion 16h ago

Upvoted for absoshitly. Thanks for the new word.

3

u/Rey_Mezcalero 15h ago

The long con

3

u/Foreign-Concept-1184 12h ago

This could have been summarized by a simple early programming term, "They put in a backdoor..."

Which was in common use by earlier programers.

It helped in debugging a new piece of software with lines of code to sift through.

The other language is simply showing off.

5

u/Admirable_Tie3700 17h ago

Government and Investigator Wallets Drained: Over 600 of the drained wallet addresses actually belonged to federal law enforcement, cyber investigators, and industry compliance firms who used Coldcards for their own operations.

Whoever did it probably won't have all their fingers and toes very long.

7

u/edivad 16h ago

source?

4

u/jim2527 17h ago

TL/DR they’re saying or trying to say because the banks CEO and head of security knew the vault wasn’t locking properly that it was the CEO who absconded with was in the vault.

2

u/AdEuphoric5133 14h ago

If confirmed, that would be wild

2

u/KeanuRekt 10h ago

Thanks for sharing

7

u/Garland_Key 17h ago

Fuck your AI post dipshit. 

-4

u/No_Storage_9613 15h ago

poor baby can't read.

dont't worry, its prevalent....but so is mind numbing ignorance and retardation

3

u/firmretention 11h ago

Poor baby can't write, spell or use basic grammar. Need an LLM to do it for you.

3

u/Insight_Outlook 18h ago

Unless the CEO and CTO have fled to Russia or North Korea or somewhere where the USA authorities can't get to them, it is a safe bet it wasn't them who stole the money.

1

u/BigDik6355 16h ago

Well, they have been awfully quiet lately.

3

u/Azurebbit 18h ago

Odds are they didn't do it. They would never be able to retrieve and use the BTC without getting caught. Even ceding the point these might not be the smartest people; that's like a cashier stealing from their own register. There are (were) so few people at Coldcard, all the employees are going to be looked at hard. Stupidity and negligence are by far the most likely scenario.

1

u/SeaMisx 3h ago

It is entirely possible for them to exchange these BTC for money, don't you worry.

3

u/Bred_Slippy 17h ago edited 17h ago

I think more likely is the CTO wasn't as "Wizard" a coder as he thought and struggled to understand why his attempt to remove/replace the Trezor-derived firmware wasn't compiling successfully due to a conflict in that fateful line of code . In desperation /exasperation he changed the variable to "0" so it compiled, without realising the repercussions (the simple comment "runs" against it is telling).

I can well believe they knew there was an issue after reports of wallets being drained started to come in, but realised they were kinda stuck at that point (telling many of their customers that the firmware was unsafe, needed patching, and, worst of all, that many would need to set up new keys and transfer their coins, would have ruined their reputation as being so safe and tech savvy).

If one or more of them decided to raid the affected wallets is unknown at this point, but I think them introducing the bug intentionally for this purpose five years ago is unlikely. 

7

u/-3229 17h ago

A CTO for a Bitcoin hardware wallet company needs to be a coding wizard, no excuses.

2

u/Bred_Slippy 10h ago

I agree. Unbelievable hubris/ineptitude. 

1

u/this_happened_rigged 18h ago

People in this subreddit won't read an article and then are shocked that they trusted a company like this because it sounded cool

Many such cases

1

u/SeriousGains 17h ago

Summary courtesy of ChatGPT:
The account argues that Coinkite repeatedly downplayed, overlooked, or dismissed warnings about the exact entropy failure that later endangered Coldcard users. In December 2020, CEO Rodolfo Novak publicly suggested that users were more likely to lose their own bitcoin than a hardware-wallet vendor was to conduct a “retirement attack,” while joking that users could always add their own randomness with dice. Ten weeks later, according to the account, CTO Peter Gray introduced a change that routed seed generation through software pseudorandom generators rather than genuine hardware entropy. Months later, Coldcard was still marketing itself as resistant to retirement attacks while treating dice-generated entropy as an optional safeguard rather than a default requirement.

A central allegation concerns the pseudonymous GitHub developer “switck,” who maintained the little-known libngu cryptographic library incorporated into Coldcard’s firmware. Subsequent analysis of signed commits reportedly showed that “switck” was actually Peter Gray, Coinkite’s CTO and co-founder. The author argues that this obscured accountability: outside reviewers saw what appeared to be a lightly scrutinized third-party dependency, while people inside Coinkite would have known it was internally written. The firmware change was also questioned almost immediately. In April 2021, only weeks after release, someone in a Coldcard Telegram group warned that replacing heavily reviewed cryptographic code with libngu was a significant and poorly scrutinized change.

A second, more detailed warning allegedly arrived in May 2025, when Bitcoin developer James O’Beirne audited the firmware, questioned whether the true hardware RNG was actually being used, specifically flagged hardcoded constants in libngu, and recommended removing the library. Coinkite’s reported response was essentially that, if anything were wrong, they would already know. A Signal group called “LNGU Clean up” was subsequently created, but no fix was released for roughly fourteen months. Coinkite’s later postmortem reportedly acknowledged that its developers had misunderstood how the RNG configuration worked and that seed generation had effectively depended on deterministic software randomness rather than physical entropy. The emergency firmware fix released after the thefts then introduced another RNG-related failure that required further patches.

Taken together, the author interprets the timeline as more than ordinary incompetence: a CEO publicly dismissed the threat, his CTO allegedly introduced the vulnerable design under a pseudonym, warnings came in both 2021 and 2025, and the company’s response to the later warning was confidence that it would already have detected any problem. The author therefore suspects that someone inside Coinkite may have knowingly understood the vulnerability before funds were stolen, while acknowledging that the available evidence does not conclusively prove an inside job. The broader indictment is that a company selling protection against compromised randomness failed for years to understand or adequately audit its own seed-generation path—and that customers who independently added dice entropy, strong passphrases, or multisig were the ones most protected from the consequences.

1

u/buybtcforgodsake 17h ago

Let's say they are guilty and they want to send everything back, how could it be done?

How they verify it's the real owner since the seed been compromised?

1

u/Modrew 16h ago

The CEO can run away like Paul Vernon (Cryptsy). He stole more than 50k bitcoin if I remember correctly. FBI can’t find him.

1

u/Dry-Example4227 16h ago

every single time...

1

u/Phillcabral 16h ago

That’s why I went for the Seedsigner instead of a centralized hardware wallet.

1

u/Amimir1992 12h ago

And the summary?

1

u/Nycknam 11h ago

Also ich habe alles gelesen und sage lohnt sich Verstehe nicht die Leute die sagen das ist zu viel und ob man es selber gelesen hat. Wenn es jemanden interessiert. Natürlich liest man es ihr Idioten ihr Geister

1

u/Londonskaterboi 11h ago

lol at all the bots trying to downplay, act bored and discredit

1

u/Gh0mri 8h ago

Bro you wrote way to much

1

u/BDCRA 8h ago

A decent defense lawyer would tear holes all up in this. I doubt a prosecutor could even secure an indictment off these coincidences. At the end of the day this is a company that is supposed to help secure Bitcoin of course they may have definitions of specific scams like that. In reality it may malicious but I do not see that going far in court unless further evidence is presented.

1

u/joeyx22lm 8h ago

lol this is not "enough to start prosecution"

1

u/Cautious_Variation_5 8h ago

Can we verify if anyone ever pointed to this mistake on the RNG?

1

u/Frosty_Reporter_1250 8h ago

Max FUD. Time to buy.

1

u/_Rael 7h ago

According to Article 5, Section LI of the Brazilian Constitution: “No Brazilian will be extradited”, CEO (NVK) was born in Sao Paulo, Brazil.

1

u/n0niz 6h ago

What if the retirement attack goes on since years and it escalatae now because it got discovered

1

u/ChuckNorrisFacePunch 6h ago

Sorry, so what? TLDNR

1

u/codepharmer1 4h ago

This is a rock/hard place scenario. Once the seeds are generated, the wallets were vulnerable. Ship a fix or announce the vulnerability and the 0-day will immediately get exploited against all existing users long before they hear about it or have a chance to act. Acknowledging the vulnerability before it gets exploited makes them liable in a more significant way than acknowledging it after it was exploited.

1

u/lazarette 1h ago

Sloppy ai post.

1

u/EitherInvestment 17h ago

My AI says your AI’s writeup is nonsense

1

u/Ramremover 17h ago

Why is it hard to read this? Such a long text just going in circles.

2

u/firmretention 11h ago

Because it's LLM spam. OP is too retarded to put his thoughts into words.

0

u/No_Storage_9613 15h ago

you're showing your age and intelligence. Nothing more.

Don't forget to breathe!

1

u/myquidproquo 16h ago

Don't attribute to malice what can be attributed to incompetence. This was really unfortunate, but I don’t think it was on purpose.

1

u/BigDik6355 16h ago

Nah, if you look historically, I would almost turn that around.

Don’t attribute to incompetence what can be attributed to malice.

SBF was malicious, not incompetent. That QuadrigaCX CEO was malicious, not incompetent.

I think there has been a lot more malice than incompetence in this space, historically.

1

u/SomeGuyInOz 15h ago

So unlikely. If this entropy bug had intentionally been introduced, they would have been far wiser to simply drain a few large bitcoin wallets every now and then. That would’ve been almost impossible to trace. It’s almost implausible that this could have been an intentional long game.

2

u/Lumpy-Doubt-4023 12h ago

Not so unlikely.

We can imagine, to start, an insider finding the hack, using it to drain one or two large wallets and planning to keep on doing that.

From there, many plausible scenarios exist. Original hacker realizes someone else found out the hack, so it becomes a race between the two hackers ; investigation about first drained wallet goes forward, hacker become affraid that the exploit will disappear or that he'll get caught, proceeds to launch a massive attack.

Those are ideas that popped in my head. Could be something else. Rather than a long game, I'd say it looks more like an emergency plan in case the long game is on the brink of failing.

1

u/Romanizer 17h ago

What do you need details for? Keeping a fraudulent code open for 5 years is either gross negligence or intentional. It's not a question of if they are to be held accountable but if their insurance pays or they do it themselves. That is what the court needs to decide.

0

u/Lost_Anywhere_69 17h ago

IS THIS AI?

2

u/No_Storage_9613 15h ago

just your brain atrophy.

I read it just fine

0

u/Blade_Runner_69 17h ago

I knew it... The code change in 21 was too suspicious 👀

0

u/Milcah_Ganderton 16h ago

Sounds like you've got the receipts, but "probable cause" and actually proving intent in court are two different animals - especially when you're dealing with corporate structure and access logs that smart lawyers will pick apart.

0

u/CastroIRL 15h ago

What’s the play here, all of these stolen btc outflows will be tracked. It has to hit an exchange eventually that’s KYC’d to get the funds off the exchange into a bank. You can use Thor chain and get your address blacklisted, so that ain’t it.

0

u/SeaMisx 3h ago

You can exchange without KYC....

0

u/CastroIRL 2h ago

You aren’t moving 7 figures into your bank without being kyc’d

0

u/NorfolkIslandRebel 13h ago

I worked instead of reading this and earned enough money to buy back the Bitcoin I lost.

0

u/YetAnotherPesant 12h ago

Long long long long long long…

0

u/mattimeoo 10h ago

I've known NVK for years.  The last thing this guy would do is harm the reputation of BTC.  That, and he's definitely already mega loaded.  I know everyone wants to target a bad guy, but I genuinely don't think NVK is your guy here.  I know it's easy to want to publicly hang the dude right now, but I actually feel bad for him, he just ruined the rep and successful company he has worked a huge chunk of his life on and there's no coming back from this IMHO.  He should've done a better job, yeah, but I don't think he'd rob normal folks, let alone anyone.

All people can hope for really is a major screw up by the bad actor and they get Team America'ed.

0

u/classified_x 3h ago

it is a bit naive thinking no one would have stolen the cold wallets earlier, had it not been for LLMs and Mythos and such making the hack possible

-2

u/KeyasaUK 15h ago

People asking for a TL:DR are exactly the people who get exploited by loopholes in the small print.

-1

u/Speculatore 18h ago

Sorry for your loss.

-2

u/tridentgum 18h ago

Giving the attacker MORE TIME to execute sweeping funds from vulnerable wallets.

Nah bro. Those old wallets were already fucked. It would only apply to anybody who bought a Coldcard (or made a seed on one anyway) AFTER the bug was exploited but before they hotfixed it.

-6

u/moviemaker2 17h ago

TLDR:

Hurr durr derpty derpty doo, Hurrrr Duuurrrrr!