About 1,816 BTC Moved From More Than 5,200 Addresses as Coldcard Firmware Bug Bypasses Hardware RNG
About 1,816 BTC was transferred from more than 5,200 addresses between July 30 and August 4 in connection with a Coldcard firmware vulnerability that bypasses the hardware random number generator. According to Odaily, Coinkite CEO Rodolfo Novak, known as NVK, said a new AI model found a Coldcard flaw that human reviewers had missed, a finding disputed by Bitcoin developers. The vulnerability affects firmware version 4.0.1 and later; NVK said the firmware had undergone at least 15 reviews. James O'Beirne said he privately raised concerns about Coldcard's random number generation in May 2025. A firmware update can fix the issue on new devices but cannot repair old seed phrases, so affected users need to generate new ones. The losses were valued at about $116 million.