Coldcard's $114M Drain: How Reputation Replaced Verification in Bitcoin Security

Woofun AI reports that a critical firmware flaw in Coldcard hardware wallets has resulted in the drainage of nearly $114 million in bitcoin, exposing a systemic failure where brand reputation supplanted technical verification. The incident implicates Coinkite CEO Rodolfo Novak, known as NVK, and raises urgent questions for the broader self-custody ecosystem, including Foundation co-founder Zach Herbert. The core issue is not merely a coding error but a structural collapse of the 'don't trust, verify' ethos that underpins Bitcoin security.

The scale of the exploit is staggering, with attackers sweeping funds from more than 709 addresses. The initial wave of theft emptied roughly 500 wallets in just 25 minutes, demonstrating the speed and precision of the attack. The vulnerability stemmed from a firmware flaw that generated wallet seeds with a fraction of their promised randomness, effectively allowing attackers to predict private keys. This specific bug entered the codebase in March 2021 and remained in public, open-source view for more than five years. Despite its visibility, the flaw went undetected by the community for half a decade, highlighting a disconnect between code availability and actual scrutiny.

The failure of open-source verification is central to understanding this breach. The maxim 'don't trust, verify' only functions when qualified people actually look at the code. For five years, effectively nobody did. While Coldcard's source code was always available for inspection, the absence of rigorous, independent review allowed the entropy bug to persist. The open-source view provided a false sense of security, assuming that transparency alone equates to safety. Without active, skilled oversight, the codebase remained vulnerable to exploitation despite being publicly accessible.

The timeline around the bug's introduction reveals a critical shift in licensing and development practices. In 2020, Coldcard's firmware carried a GPL open-source license.

However, two days after a competitor announced a device building on that GPL code, Coinkite CEO Rodolfo Novak, known as NVK, publicly stated in a since-deleted tweet that he regretted choosing GPL. That November, Coldcard adopted a new license with the Commons Clause, whose own FAQ states plainly that the resulting software is no longer open source. A sweeping rewrite followed, and the March 2021 commit that stripped out the last GPL code is the same commit that broke seed generation. This correlation suggests that the licensing pressure may have influenced the scope or speed of the rewrite.

Free and open-source software principles exist precisely to keep security from depending on any one company's choices. These principles cannot come with a personality exception. The documented facts are narrower and still damning: a license change made to restrict competitors preceded a rushed replacement of battle-tested cryptographic code, and the replacement contained the flaw now draining wallets. Nobody can measure exactly how much licensing pressure shaped the overhaul, which also pursued legitimate technical goals.

However, the sequence of events indicates that commercial defensibility may have compromised cryptographic integrity.

Hostility toward early researchers further eroded the security landscape. In August 2020, researchers from Shift Crypto and Nunchuk disclosed a multisig verification flaw in Coldcard. Coinkite acknowledged the bug and shipped a fix, but NVK, on the Citadel Dispatch podcast, simultaneously branded the disclosure 'PR terrorism' and questioned whether a researcher without a CVE counted as a professional. This public disparagement of legitimate security research created a hostile environment for those attempting to improve the product. The dismissal of researchers who lacked formal credentials like a CVE undermined the collaborative nature of security auditing.

The suppression of independent audits continued into 2023. When the WalletScrutiny project reported problems reproducing older Coldcard builds, the response labeled the project incompetent or malicious and floated litigation. Independent follow-up later found genuine reproduction problems in older releases and concluded nobody had acted in bad faith. The threat of legal action against researchers who identified technical issues serves as a powerful deterrent to future audits. By framing legitimate technical inquiries as malicious acts, the company discouraged the very scrutiny necessary to maintain security.

Every public attack on a researcher changes the math for the next one. Independent review is slow, difficult, and usually unpaid. A researcher weighing months of that work against the prospect of ridicule, blocklists, and legal threats will often spend their time elsewhere. Nobody can prove this culture directly caused the entropy bug to go unnoticed.

However, what can be said with confidence is that security depends on people being willing to look, and the environment around Coldcard punished looking. The chilling effect on security research is a direct consequence of this defensive posture.

Woofun AI data shows that psychological mechanisms like the illusory truth effect and halo effect contributed to this epistemic capture. The illusory truth effect makes repeated claims feel independently confirmed even when they trace to a single source. The halo effect converts status, confidence, and popular products into presumed technical authority. Year after year, the same assertions traveled through the same podcasts and feeds: critics were shills, researchers were terrorists, competitors were clones. Repetition did the work evidence should have done, and confidence became a substitute for proof. BTC Sessions host Ben Perrin described the mechanism with unusual honesty in a recent livestream, admitting he gave the behavior a pass because he assumed the hubris came packaged with a superior ability to create and secure.

The crisis of confidence now rippling through self-custody is the bill coming due. The first priority for the entire industry in the aftermath of the exploit is users: circulate the migration guidance and make clear that updating firmware cannot repair a seed generated on vulnerable versions. Then the industry has behind-the-scenes work to do. Old recommendation pages, show notes, and product guides carry years of claims that were repeated rather than checked, and they deserve corrections with primary sources attached. Bitcoin media needs to become adversarial again, applying the same scrutiny to friends, sponsors, and advertisers that it applies to strangers. The fix is the founding instruction, applied without favorites this time. Do not trust the vendor. Do not trust the vendor's critics. Verify.