Odds are @NVK knew about his CTO's use of an alias to author the exploit. 🚨 When #Coldcard firmware v4.0.0 was released (March 2021), Coinkite’s official blog post explicitly thanked **@switck** for the new crypto library: > “Huge thanks to @switck for the new source code library!” That library is `libngu` — the exact code later shown to contain the defective RNG path. The same release cycle integrated it via a commit authored by **doc-hex** (“First pass w/ libNgU”). Peter D. Gray (DocHex) is co-founder and CTO. NVK (Rodolfo Novak) is co-founder and CEO. They have run a small, tightly integrated team for more than a decade. Critical cryptographic code being contributed under a pseudonym while the commits were GPG-signed by Peter’s key, and while Peter himself was merging/integrating the work under his public handle, is not something that would realistically stay hidden from the other co-founder. Once the GPG + phone-number linkage between DocHex and switck became widely discussed (early August 2026), there has been no public statement from NVK claiming he believed switck was an independent external contributor or that he was unaware of the dual identity. Given the public thank-you to switck in official Coinkite communications, the dual-identity commit pattern (switck for the library, doc-hex for the integration), and the long-standing co-founder relationship, the most straightforward reading is that NVK was aware switck was Peter’s (or the core team’s controlled) alias. View quoted note →