Skip to main content
COINSCIPHER
Subscribe
Bitcoin · News

Coldcard $114M Bitcoin Hack May Be Linked to Coinkite CTO

Bitcoin developer James O'Beirne says GPG signatures connect Coldcard's flawed randomness code to Coinkite CTO Peter Gray, as losses from the exploit reach roughly $114 million

By Eric Nkando, senior writer · 4 min read · Updated 15 Sep 2026
XLinkedIn

!Close-up illustration of two Coldcard hardware wallets surrounded by digital particle effects, representing an investigation into a firmware randomness flaw linked to the Coldcard wallet exploit.

  • A Bitcoin developer says GPG signatures tie the flawed randomness code to Coinkite CTO Peter Gray.
  • Developer James O’Beirne says he flagged the same bug to Coinkite in May 2025 and was brushed off.
  • The exploit has now drained roughly 1,816 BTC, worth about $114 million, from more than 5,200 addresses since July 30.

The company that built one of Bitcoin’s most trusted hardware wallets may have shipped the flaw that broke it, and even more interesting is that the person who wrote the code may be the same person who now runs the company’s engineering.

The Pseudonym That Wasn’t

For years, a GitHub contributor going by “Switck” maintained libngu, the cryptographic library later found to generate predictable seed phrases on Coldcard devices. Bitcoin developer James O’Beirne published an analysis Monday arguing that Switck’s real identity is Peter Gray, Coinkite’s co-founder and chief technology officer.

His case rests on GPG signatures: 58 commits made under the Switck name carry valid signatures from Gray’s personal key, the same key that signs Gray’s commits under his own name in the same repository. Switck’s account never published a key of its own.

That detail matters because Coldcard’s production firmware pulls libngu in as a direct dependency. If the identification holds, the person responsible for catching this kind of bug may also be the person who wrote it.

O’Beirne adds a second layer to the story. He says he emailed Coinkite in May 2025 about the random-number implementation in libngu, specifically calling it out as questionable. According to O’Beirne, the company’s response was that a real issue would likely have surfaced by now. It didn’t surface until an attacker found it first.

What Happens Now

Coinkite has not addressed the identification claim directly. Its public response has focused on the technical fix and user migration, not on who wrote the original code. The company’s advisory, updated as the investigation continues, still tells affected users their only real fix is generating a new seed on updated firmware and moving funds over, since a firmware patch cannot repair a key that was already compromised.

For the wider market, this shifts the story from a technical failure to a governance question. A firmware bug is one kind of risk. A company allegedly dismissing an outside warning about that exact bug, from the same person who wrote it, is a different kind of risk, and one that due-diligence conversations around hardware wallet vendors are likely to raise for a long time after this specific incident is closed.

Source:

Coinkite’s official security advisory

Coldcard firmware repository on GitHub

![](https://secure.gravatar.com/avatar/2510b5bff6da2a621dbc7f1cf5b06ef4806fc5df5b7efac038bc48d4ce190e39?s=80&d=mm&r=g)

Written by

Eric Nkando

I’m Eric Nkando, a crypto and crypto tax enthusiast, with other extensive experiences in forex and stock markets. I believe crypto and blockchain are no longer alien topics and I’m here to help investors tackle emerging issues of taxation and prudential investment strategies. My approach? Delivering clear, insightful analysis on digital assets, market trends, and trading strategies, bridging complex technical concepts with practical investment perspectives. My work has been widely published on leading financial platforms such as Investing.com, FXLeaders, and The Distributed.

Analysts Flag Security Gaps in Standard Chartered-Backed Stablecoin

August 14, 2026

Metaplanet Denies Bitcoin Sale, Unveils BitBonds Program

August 13, 2026

Could Ripple’s Own Stablecoin Undercut Demand for XRP?

August 13, 2026

Binance bStocks Passes xStocks in Tokenized Stocks Race

August 13, 2026

More in Crypto News Today

  • [Analysts Flag Security Gaps in Standard Chartered-Backed Stablecoin

1 month ago](/crypto-news/analysts-flag-security-gaps-in-standard-chartered-backed-stablecoin/)

  • [Metaplanet Denies Bitcoin Sale, Unveils BitBonds Program

1 month ago](/bitcoin/metaplanet-denies-bitcoin-sale-unveils-bitbonds-program/)

  • [Could Ripple’s Own Stablecoin Undercut Demand for XRP?

1 month ago](/xrp/could-ripples-own-stablecoin-undercut-demand-for-xrp/)

  • [Binance bStocks Passes xStocks in Tokenized Stocks Race

1 month ago](/crypto-news/binance-bstocks-passes-xstocks-in-tokenized-stocks-race/)

  • [BOE Digital Pound Lab Tests Stablecoin-CBDC Interoperability

1 month ago](/crypto-news/boe-digital-pound-lab-tests-stablecoin-cbdc-interoperability/)

Top gainers 24h

  • Loading market data...

Top losers 24h

  • Loading market data...

Make sense of crypto.

Weekly analysis. No hype, no jargon. Free.