How a bug in Coldcard’s code went unnoticed for years, leading to $100 million in hacked funds

The bug that survived verification

Though users were able to inspect Coldcard’s code, they didn’t really look too closely. The seed-generation failure entered Coldcard during a major 2021 software change and went unnoticed for years.

Coinkite described firmware version 4.0.0 as "All New Code, Same Great Features." The release replaced its code with new equivalents, added reproducible builds and thanked an account named “switck” for the “new source code library."

Bitcoin developer James O’Beirne identified the “switck” account as belonging to Coinkite co-founder Peter Gray after finding 58 code changes published under that name carrying the same cryptographic signature Gray used on changes published under his own name.

Such signatures function like tamper-resistant digital autographs, showing that the same secret signing key approved both sets of work. Coinkite has not responded to the identity claim.

Switck developed libngu, a collection of reusable code incorporated into the Coldcard firmware installed on customers’ devices. One of its jobs was to help produce the randomness used when creating wallets.

O’Beirne said he questioned that process while auditing Coldcard’s code in May 2025. After tracing the source of the wallet’s randomness to libngu, he raised the possibility of a defect with Coinkite.

The company replied that a genuine problem would probably have been discovered already, according to O’Beirne. “This is the same guy that shrugged off my report of the possibility of the defect in May 2025,” he later wrote of Peter Gray.