COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

nvk.wtf receipts index

nvkwtf-receipts

https://nvk.wtf/receipts

Latest reviewed change

source content difference between and

The receipts index grew from 13 to 14, adding a screenshot of an August 2023 exchange in which thorie argued a user cannot practically verify the absence of a backdoor in a hardware wallet and NVK replied by repeating the phrase in alternating capitals.

seen +6 -1 full history below
 2021
 2020
 
-13 receipts
+14 receipts
 
 Enlarge this screenshot
 d7r, reposted by NVK

First lines only. The complete diff is in the timeline below.

Organisation
nvk.wtf
Evidence role
Aggregator
Published
not established
Source changes
2
Detected differences
2
Unreviewed
0
Copies held
3

Screenshots of NVK posts, some already deleted, kept with dates and, where one exists, a link to an independent archive; solicits further screenshots via the #wtfnvk hashtag. Same operator and stance caveats as nvkwtf-articles. The screenshots are third-hand material: anything that matters here is captured from the original post or the independent archive it links before it backs a claim.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +6 -1

    The receipts index grew from 13 to 14, adding a screenshot of an August 2023 exchange in which thorie argued a user cannot practically verify the absence of a backdoor in a hardware wallet and NVK replied by repeating the phrase in alternating capitals.

    seen · Captured here 4,002 chars
    What changed from the previous capture 7 lines
     2021
     2020
     
    -13 receipts
    +14 receipts
     
     Enlarge this screenshot
     d7r, reposted by NVK
     
     Seth For Privacy's reply, calling it a misreading of Foundation's code
     (opens in a new tab)
    +Enlarge this screenshot
    +Posted 11 Aug 2023
    +
    +thorie's post names no vendor: the claim is about hardware wallets in general, and specifically that a user cannot practically verify the absence of a backdoor in one. NVK's reply repeats the phrase back in alternating capitals rather than answering it. No permalink was captured with the screenshot, so it is filed without a source link.
    +
     Enlarge this screenshot
     Posted 20 Jun 2023
     
    
    Extracted text as captured
    Receipts
    
    Screenshots of what the Coldcard side has published or endorsed — NVK, the COLDCARD account, Coinkite staff, and posts NVK reposted. Some are already deleted, others were captured while still up in case they do not stay that way. Kept with the dates and, where one exists, a link to an independent archive so you can check them yourself.
    
    Share your own screenshots — deleted or not yet — on X or Nostr with the hashtag #wtfnvk to get them added.
    
    Newest first
    Oldest first
    All years
    2026
    2024
    2023
    2022
    2021
    2020
    
    14 receipts
    
    Enlarge this screenshot
    d7r, reposted by NVK
    Posted 4 Aug 2026
    
    The words are d7r's. What this records is that NVK reposted them — the repost line is at the top of the screenshot. Note that Derek Ross, whose post d7r is reading as a friend flipping, replies underneath that he would not put it that way and still considers NVK a friend; that reply is part of the same capture.
    
    Original
    Enlarge this screenshot
    Posted 30 Jul 2026
    
    The grey bar is a post that stood between Kevin Loaec's opening report and his "Could be, will keep digging" reply. X says its author deleted it and does not say who that was. Loaec is at Wizardsardine, whose writeup of the vulnerability is on the Articles page; Jameson Lopp is a Casa co-founder. Neither is Coinkite — the receipt here is NVK's reply.
    
    Original
    Enlarge this screenshot
    Posted 7 Apr 2024
    
    The highlight is part of the shared screenshot, not of the original post.
    
    Via Printer on Nostr
    (opens in a new tab)
    
    Enlarge this screenshot

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +71 -17

    The operator widened the page from NVK's own posts to what the Coldcard side published or endorsed, including the COLDCARD account, Coinkite staff and NVK's reposts, added sort and year filters and a receipt count, and grew the index from 7 screenshots to 13. The gap since 4 Aug is this collector's: a stale required_text marker blocked 36 consecutive polls, so intermediate states of this page were never captured and this diff spans the whole rewrite.

    seen · Captured here 3,618 chars
    What changed from the previous capture 88 lines
     Receipts
     
    -Screenshots of NVK's posts — some already deleted, others captured while they are still up, in case they do not stay that way. Kept with the dates and, where one exists, a link to an independent archive so you can check them yourself.
    +Screenshots of what the Coldcard side has published or endorsed — NVK, the COLDCARD account, Coinkite staff, and posts NVK reposted. Some are already deleted, others were captured while still up in case they do not stay that way. Kept with the dates and, where one exists, a link to an independent archive so you can check them yourself.
     
     Share your own screenshots — deleted or not yet — on X or Nostr with the hashtag #wtfnvk to get them added.
     
    +Newest first
    +Oldest first
    +All years
    +2026
    +2024
    +2023
    +2022
    +2021
    +2020
    +
    +13 receipts
    +
     Enlarge this screenshot
    -Posted 13 Feb 2020
    +d7r, reposted by NVK
    +Posted 4 Aug 2026
    +
    +The words are d7r's. What this records is that NVK reposted them — the repost line is at the top of the screenshot. Note that Derek Ross, whose post d7r is reading as a friend flipping, replies underneath that he would not put it that way and still considers NVK a friend; that reply is part of the same capture.
    +
     Original
     Enlarge this screenshot
    -Posted 30 Jul 2020
    +Posted 30 Jul 2026
     
    -Via @zherbert
    -(opens in a new tab)
    +The grey bar is a post that stood between Kevin Loaec's opening report and his "Could be, will keep digging" reply. X says its author deleted it and does not say who that was. Loaec is at Wizardsardine, whose writeup of the vulnerability is on the Articles page; Jameson Lopp is a Casa co-founder. Neither is Coinkite — the receipt here is NVK's reply.
     
    -Enlarge this screenshot
    -Posted 29 Jul 2021
    -
    -Via pingstahu on Nostr
    -(opens in a new tab)
    -
    -Enlarge this screenshot
    -Posted 8 Sept 2021
    -Original
    -Enlarge this screenshot
    -Posted 21 Jan 2024
     Original
     Enlarge this screenshot
     Posted 7 Apr 2024
     (opens in a new tab)
     
     Enlarge this screenshot
    -Posted 31 Jul 2026
    +Posted 21 Jan 2024
    +Original
    +Enlarge this screenshot
    +Posted 24 Dec 2023
    +
    +The "cloners" are Foundation, whose Passport firmware is the file in the screenshot, and this is two and a half years before the Coldcard entropy vulnerability broke. Seth For Privacy answered the same day, for that side: "NVK has gone out of his way to lie (or blatantly misread) our code to FUD a competitor on Christmas Eve, abhorrent as that is. Unfortunately we are all blocked by NVK so have no way to respond directly to him. The code he's screenshotted (and not linked to, funnily enough!) is…" This capture surfaced again in July 2026, when Sam DeF reposted it with "Well, that aged well".
     
     Via @sDefrees
     (opens in a new tab)
    +
    +RELATED
    +
    +Seth For Privacy's reply, calling it a misreading of Foundation's code
    +(opens in a new tab)
    +Enlarge this screenshot
    +Posted 20 Jun 2023
    +
    +Wallet Scrutiny is the review project run by Leo Wandersleb, who had asked Coldcard in 2021 where its entropy comes from — that thread is on the Reactions page. This post names no particular review, so what it connects to is the project, not a finding. Both posts are NVK's own; the quoted one is his, quoted by himself.
    +
    +Original
    +Enlarge this screenshot
    +Peter Gray, Coinkite CTO
    +Posted 12 Feb 2022
    +
    +@DocHex is Peter Gray; the CTO title is the post's own words, not an inference.
    +
    +Original
    +Enlarge this screenshot
    +COLDCARD account
    +Posted 10 Oct 2021
    +Original
    +Enlarge this screenshot
    +Posted 8 Sept 2021
    +Original
    +Enlarge this screenshot
    +Posted 29 Jul 2021
    +
    +Via pingstahu on Nostr
    +(opens in a new tab)
    +
    +Enlarge this screenshot
    +Posted 22 Dec 2020
    +
    +The "account that no longer exists" banner belongs to the link in the first post, not to anything in the thread: t.co/RJQvG8NvzV resolves to a Cobo Vault post of 21 December 2020, and Cobo Vault is the account X reports as gone. No permalink to this thread itself could be found, so it is filed without a source link — and without a deletion date, which would be a guess.
    +
    +Enlarge this screenshot
    +Posted 30 Jul 2020
    +
    +Via @zherbert
    +(opens in a new tab)
    +
    +Enlarge this screenshot
    +Posted 13 Feb 2020
    +Original
    
    Extracted text as captured
    Receipts
    
    Screenshots of what the Coldcard side has published or endorsed — NVK, the COLDCARD account, Coinkite staff, and posts NVK reposted. Some are already deleted, others were captured while still up in case they do not stay that way. Kept with the dates and, where one exists, a link to an independent archive so you can check them yourself.
    
    Share your own screenshots — deleted or not yet — on X or Nostr with the hashtag #wtfnvk to get them added.
    
    Newest first
    Oldest first
    All years
    2026
    2024
    2023
    2022
    2021
    2020
    
    13 receipts
    
    Enlarge this screenshot
    d7r, reposted by NVK
    Posted 4 Aug 2026
    
    The words are d7r's. What this records is that NVK reposted them — the repost line is at the top of the screenshot. Note that Derek Ross, whose post d7r is reading as a friend flipping, replies underneath that he would not put it that way and still considers NVK a friend; that reply is part of the same capture.
    
    Original
    Enlarge this screenshot
    Posted 30 Jul 2026
    
    The grey bar is a post that stood between Kevin Loaec's opening report and his "Could be, will keep digging" reply. X says its author deleted it and does not say who that was. Loaec is at Wizardsardine, whose writeup of the vulnerability is on the Articles page; Jameson Lopp is a Casa co-founder. Neither is Coinkite — the receipt here is NVK's reply.
    
    Original
    Enlarge this screenshot
    Posted 7 Apr 2024
    
    The highlight is part of the shared screenshot, not of the original post.
    
    Via Printer on Nostr
    (opens in a new tab)
    
    Enlarge this screenshot

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. Earliest copy held
    seen · Captured here 919 chars
    Extracted text as captured
    Receipts
    
    Screenshots of NVK's posts — some already deleted, others captured while they are still up, in case they do not stay that way. Kept with the dates and, where one exists, a link to an independent archive so you can check them yourself.
    
    Share your own screenshots — deleted or not yet — on X or Nostr with the hashtag #wtfnvk to get them added.
    
    Enlarge this screenshot
    Posted 13 Feb 2020
    Original
    Enlarge this screenshot
    Posted 30 Jul 2020
    
    Via @zherbert
    (opens in a new tab)
    
    Enlarge this screenshot
    Posted 29 Jul 2021
    
    Via pingstahu on Nostr
    (opens in a new tab)
    
    Enlarge this screenshot
    Posted 8 Sept 2021
    Original
    Enlarge this screenshot
    Posted 21 Jan 2024
    Original
    Enlarge this screenshot
    Posted 7 Apr 2024
    
    The highlight is part of the shared screenshot, not of the original post.
    
    Via Printer on Nostr
    (opens in a new tab)
    
    Enlarge this screenshot
    Posted 31 Jul 2026
    
    Via @sDefrees
    (opens in a new tab)
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.