Timeline of #Coldcard Heist.
November 2012 onward
Peter D. Gray creates a public Clarity.fm profile under his real name, based in Toronto.
2012–2013
Peter D. Gray and Rodolfo Novak (NVK) co-found Coinkite in Toronto. Gray becomes CTO; Novak becomes CEO. The company starts as a Bitcoin services platform and later shifts to hardware. It remains a small team of roughly five.
November 7, 2013
Peter D. Gray creates his GPG key (uid “Peter D. Gray <[email protected]>”). This key later signs dozens of commits under the switck identity, including the critical libngu changes.
December 2017
Coinkite announces the Coldcard hardware wallet. Pre-orders open for 2018 shipping.
July 25, 2018
First Coldcard Mk1 units ship.
August 2019
Peter creates the anonymous identity “switck,” named after the Matrix character Switch, and uses a still of that character as the profile picture. The name plays on “making the switch.” First post notes DEF CON is a good time to start a new identity. Later commits under this name are often single-word or extremely terse.
2019–2020 onward
Bitcoin educators and influencers, including BTC Sessions, begin promoting Coldcard as one of the most secure Bitcoin hardware wallets.
July 2020
Foundation Devices announces the Passport, built in part on Coldcard’s then-GPLv3 firmware.
Early 2020s
Ten31 (Managing Partners include Matt Odell and Marty Bent) becomes Coinkite’s sole external investor.
January 8, 2021
Coldcard firmware 3.2.1 announces the license change from GPL to MIT + Commons Clause.
January 5, 2021
Domain switck.com is registered via easyDNS using a Toronto-area privacy service (MyPrivacy.net, Etobicoke). The same day the switck account posts the single word “got.”
January 28, 2021
Under switck, the vulnerable preprocessor guard (#ifndef MICROPY_HW_ENABLE_RNG) is committed to libngu (f19de05). This fails to force the hardware TRNG when the macro is set to zero. The library is co-maintained with scgbckbone (later linked to Andrej Virgovic).
March 1, 2021
Under doc-hex, the commit “First pass w/ libNgU” (b18723dd) replaces remaining Trezor-derived GPL crypto and BIP-39 code with libngu (submodule from switck/libngu). Seed generation switches from the hardware path (ckcc.rng_bytes) to ngu.random.bytes(). This is the point real hardware entropy is replaced by the weak software PRNG. Coinkite release notes later thank @switck for the library.
March 17, 2021
Firmware v4.0.0 is released containing the new path.
March 29, 2021
Firmware 4.0.1 ships. Seeds generated under this and later affected versions fall back to the software PRNG, yielding roughly 40 bits of effective entropy on Mk2/Mk3 (roughly 72 bits on later models that mixed limited secure-element data).
Around April 2021
Public users begin questioning the LibNgU rewrite and the replacement of the prior crypto stack.
February 2022
Peter (as DocHex) publicly states that as CTO he encourages Coinkite developers to operate under nyms, stay low-profile about their employer, and notes he may appear to author their GitHub commits.
2022
Early reports of individual Coldcard wallets being drained appear. At least one user claims that reporting the issue to Coinkite resulted in being blocked.
May 2025
James O’Beirne audits the firmware, identifies the low-star, pseudonymously maintained libngu library as the RNG source, and reports doubts that the true hardware RNG is in use. He advises removing it. Coinkite replies that if something were wrong “we’d already know about it by now.” The warning is not acted on.
July 30, 2026
Attackers begin draining affected wallets. An initial wave takes roughly 594 BTC (\~$38 million) from about 500 addresses in \~25 minutes. Later waves push tracked totals higher (1,000+ BTC / $70–88 million+ range). Coinkite publishes a security advisory the same day acknowledging the 2021 entropy failure.
July 31, 2026
Coinkite releases fixed firmware (4.2.0 Mk3, 5.6.0 Mk4/Mk5, 1.5.0Q). Existing weak seeds remain compromised and must be migrated. Multiple reports note NVK is deleting older tweets from the 2020 period related to the license change and open-source decisions.
July 31 – August 4, 2026
Researchers link switck to Peter Gray / DocHex via matching GPG signatures on dozens of libngu commits (including the January 2021 guard), the shared phone number ending in 44, the Toronto-area domain registration, the Matrix Switch avatar and name, and overlapping contribution patterns. Peter’s LinkedIn, previously public, is made private.
November 2012 onward
Peter D. Gray creates a public Clarity.fm profile under his real name, based in Toronto.
2012–2013
Peter D. Gray and Rodolfo Novak (NVK) co-found Coinkite in Toronto. Gray becomes CTO; Novak becomes CEO. The company starts as a Bitcoin services platform and later shifts to hardware. It remains a small team of roughly five.
November 7, 2013
Peter D. Gray creates his GPG key (uid “Peter D. Gray <[email protected]>”). This key later signs dozens of commits under the switck identity, including the critical libngu changes.
December 2017
Coinkite announces the Coldcard hardware wallet. Pre-orders open for 2018 shipping.
July 25, 2018
First Coldcard Mk1 units ship.
August 2019
Peter creates the anonymous identity “switck,” named after the Matrix character Switch, and uses a still of that character as the profile picture. The name plays on “making the switch.” First post notes DEF CON is a good time to start a new identity. Later commits under this name are often single-word or extremely terse.
2019–2020 onward
Bitcoin educators and influencers, including BTC Sessions, begin promoting Coldcard as one of the most secure Bitcoin hardware wallets.
July 2020
Foundation Devices announces the Passport, built in part on Coldcard’s then-GPLv3 firmware.
Early 2020s
Ten31 (Managing Partners include Matt Odell and Marty Bent) becomes Coinkite’s sole external investor.
January 8, 2021
Coldcard firmware 3.2.1 announces the license change from GPL to MIT + Commons Clause.
January 5, 2021
Domain switck.com is registered via easyDNS using a Toronto-area privacy service (MyPrivacy.net, Etobicoke). The same day the switck account posts the single word “got.”
January 28, 2021
Under switck, the vulnerable preprocessor guard (#ifndef MICROPY_HW_ENABLE_RNG) is committed to libngu (f19de05). This fails to force the hardware TRNG when the macro is set to zero. The library is co-maintained with scgbckbone (later linked to Andrej Virgovic).
March 1, 2021
Under doc-hex, the commit “First pass w/ libNgU” (b18723dd) replaces remaining Trezor-derived GPL crypto and BIP-39 code with libngu (submodule from switck/libngu). Seed generation switches from the hardware path (ckcc.rng_bytes) to ngu.random.bytes(). This is the point real hardware entropy is replaced by the weak software PRNG. Coinkite release notes later thank @switck for the library.
March 17, 2021
Firmware v4.0.0 is released containing the new path.
March 29, 2021
Firmware 4.0.1 ships. Seeds generated under this and later affected versions fall back to the software PRNG, yielding roughly 40 bits of effective entropy on Mk2/Mk3 (roughly 72 bits on later models that mixed limited secure-element data).
Around April 2021
Public users begin questioning the LibNgU rewrite and the replacement of the prior crypto stack.
February 2022
Peter (as DocHex) publicly states that as CTO he encourages Coinkite developers to operate under nyms, stay low-profile about their employer, and notes he may appear to author their GitHub commits.
2022
Early reports of individual Coldcard wallets being drained appear. At least one user claims that reporting the issue to Coinkite resulted in being blocked.
May 2025
James O’Beirne audits the firmware, identifies the low-star, pseudonymously maintained libngu library as the RNG source, and reports doubts that the true hardware RNG is in use. He advises removing it. Coinkite replies that if something were wrong “we’d already know about it by now.” The warning is not acted on.
July 30, 2026
Attackers begin draining affected wallets. An initial wave takes roughly 594 BTC (\~$38 million) from about 500 addresses in \~25 minutes. Later waves push tracked totals higher (1,000+ BTC / $70–88 million+ range). Coinkite publishes a security advisory the same day acknowledging the 2021 entropy failure.
July 31, 2026
Coinkite releases fixed firmware (4.2.0 Mk3, 5.6.0 Mk4/Mk5, 1.5.0Q). Existing weak seeds remain compromised and must be migrated. Multiple reports note NVK is deleting older tweets from the 2020 period related to the license change and open-source decisions.
July 31 – August 4, 2026
Researchers link switck to Peter Gray / DocHex via matching GPG signatures on dozens of libngu commits (including the January 2021 guard), the shared phone number ending in 44, the Toronto-area domain registration, the Matrix Switch avatar and name, and overlapping contribution patterns. Peter’s LinkedIn, previously public, is made private.
4974❤️83🤙6❤️4👀4👍4🔥3
