AI May Have Found The Coldcard Flaw. Then $75 Million In Bitcoin Vanished
A five-year-old firmware error made supposedly secure Bitcoin wallet seeds searchable. The manufacturer suspects AI found the flaw. There is no evidence yet, but the implications are enormous, and affected. . .
A five-year-old firmware error made supposedly secure Bitcoin wallet seeds searchable. The manufacturer suspects AI found the flaw. There is no evidence yet, but the implications are enormous, and affected Coldcard owners need to move now. “Eight years of stacking, gone. ”That was the headline of adevastating post on the Bitcoin subredditthis weekend. The writer, 39, said two bitcoin accumulated over eight years had been drained from a Coldcard wallet. The money was supposed to provide a financial cushion before 50. The owner had chosen Bitcoin as protection against sanctions, inflation and a weak national currency, then stored it on a device widely praised as one of the most secure hardware wallets available. An even larger first-person account has come fromToronto-born author and entrepreneur Jonathan Goodman. Goodmanwrote on Xand in alonger LinkedIn postthat 18. 25245043 BTC disappeared from his wallets between 9:36 p. m. and 9:43 p. m. on July 29. He valued the loss at just over $1. 6 million—a figure consistent with Canadian dollars at the time, although his post does not specify the currency. Goodman said his keys were held on a Coldcard in a safety-deposit box, the device had never connected to the internet and he had never shared his seed phrase. He learned what had happened after opening Wasabi to view the wallets and seeing the withdrawals. “I did everything right,” he wrote. Goodman said he was filing reports with police and the Ontario Securities Commission, while expecting that the money would not be recovered. His loss and the Reddit account are self-reported and have not been independently verified through transaction details published with the posts. Their timing and descriptions are consistent with the known incident. The mass theft surrounding them has been established on-chain. Goodman describes hackers using AI to brute-force seed phrases. That’s his understanding of the attack, not separate evidence of AI involvement. The public record establishes weakened seed generation and automated theft; it does not reveal which tools found the vulnerability. As of August 1,Galaxy Research saysit is tracking two waves involving 1,158. 81 BTC, worth an amount ranging from US$75 million to $88 million, taken from 2,673 Bitcoin addresses and held across seven attacker addresses. The addresses do not represent 2,673 individual people; one wallet and one person can control many addresses. The expanding count does show that the original estimate, 594 BTC from roughly 500 addresses, captured only part of the event. The victims did not necessarily expose recovery phrases, connect devices to the internet or fall for phishing. A firmware error may have made the phrases guessable from the day they were created. Coldcard manufacturer Coinkite now says AI may have discovered the error. That claim remains speculation. Its plausibility however is what makes the incident much larger than a cryptocurrency story, and possibly tied into other widely reported AI stories of the past several months. What actually failedA hardware wallet does not hold bitcoin. The bitcoin remains recorded on the blockchain. The device holds the private keys that authorize its movement. Those keys normally begin with a recovery seed generated from enough randomness to make guessing it effectively impossible. A standard 12-word seed targets 128 bits of entropy: a search space so large that brute force is not considered a realistic attack. Coldcard’s firmware failed at that foundational step. In March 2021, Coinkite changed the path used to generate wallet seeds. The firmware was meant to call the device’s hardware random-number generator. A build and integration error instead routed the request to a deterministic software fallback inherited from MicroPython, according to thetechnical investigation by Block’s Bitcoin Engineering and Security teams. The mistake was extremely small. One component checked whether a setting called MICROPY_HW_ENABLE_RNG existed. It did exist, but its value was zero. The check passed anyway. Two random-number functions had compatible signatures, the build completed without an error, and the wallet displayed perfectly normal seed words. The words were valid, but insufficiently random. Coinkite estimates that affected Mk2 and Mk3 seeds may have had about 40 bits of effective security. Later Mk4, Mk5 and Q devices mixed in additional secure-element data, raising the estimate to roughly 72 bits: materially better, still far below the intended 128. Forty bits is approximately 1. 1 trillion possibilities. That doesn’t mean every affected seed can be recovered instantly. Block’s Bitcoin Engineering and Security teams caution that the practical cost also depends on constraining the device identifier, boot timing, previous calls to the generator and address-derivation work. The active theft demonstrates that at least one attacker learned enough to make the search operational. Once the attacker had a workable candidate-generation process, the public blockchain supplied the verification layer. Candidate seeds could be turned into addresses and compared with addresses containing bitcoin. A match produced the corresponding private key. The attacker could then sign an ordinary transaction and empty the address without touching the physical device. To the Bitcoin network, that signature was valid. There was no unauthorized login to flag and no transaction for a bank to reverse. The distinction between a stolen key and a legitimately used key does not exist at the protocol level. Bitcoin’s cryptography was not cracked. The product responsible for creating the keys made them searchable. Did AI find the flaw?Coinkite’s technical accountsays its source code has always been publicly available, so the company “has to assume” someone used AI to examine previous firmware and find the issue. It also discloses an extraordinary detail: several weeks before the theft, Coinkite gave its code to what it describes as one of the best available AI models for a security review. The model found nothing serious. There is currently no public evidence identifying the attacker, the discovery process or the tools used. Blockchain analysis can reveal transaction patterns and movements. It cannot reveal whether a human researcher, an AI coding agent or a mixed team found the vulnerability. The company’s statement should therefore be read as a hypothesis, not attribution. Coinkite co-founder Rodolfo Novak hasseparately saidthe company takes full accountability for the firmware bug and apologized to users. AI is also a convenient frame for Coinkite. It moves attention from the absence of end-to-end verification toward an unknowable attacker capability. The company has accepted responsibility; its AI theory still should not be repeated as fact. The possible role of AI can be divided into three parts:1. Creating the vulnerability: This was a conventional software integration error introduced by humans in 2021. 2. Discovering the vulnerability: AI may have accelerated examination of the open-source code and its history. This is plausible and unproved. 3. Exploiting the vulnerability: Once understood, the attack required optimized candidate generation, blockchain matching and automated transaction signing. Those are conventional computing tasks. Generative AI was not required to execute them. The strongest formulation supported by the evidence is that AI may have helped an attacker discover and operationalize a five-year-old bug. Cybernewsreports Coinkite ran one of the best available AI models over their own code a few weeks earlier and it found neither this bug nor anything serious. Why the AI theory is plausibleThis is the kind of error modern coding agents are becoming unusually good at finding. It crossed repository boundaries, dependency code, build configuration and end-to-end call resolution. A surface reading showed that the intended hardware generator existed in the firmware. The failure became visible only by tracing which implementation wallet generation actually reached after compilation. A model in a chat window can miss that. An agentic system with access to the entire repository, Git history, dependency versions, a build environment, call-graph tools, test harnesses and repeated execution has a much better chance. That is the scaffolding distinction. The model is one component. The surrounding system turns code comprehension into a vulnerability-discovery pipeline. Open source remains essential to security because defenders can inspect and reproduce the code. It also makes the complete history available to attackers. AI changes the cost and scale of that inspection. Every abandoned branch, inherited dependency, stale build flag and forgotten security assumption can now be examined repeatedly by machines that do not become bored. The asymmetry is brutal. A defender has to find every consequential error before release and continue finding them across every update. An attacker needs one overlooked error attached to enough money. Coinkite’s own failed AI review adds another warning. Simply running code through AI is not a security control. Results depend on the model, context supplied, tools, tests, prompts, iteration and whether the system can verify the behavior of the compiled product rather than comment on source files in isolation. If AI involvement is confirmed, the Coldcard attack will be remembered as an early example of AI changing vulnerability economics. The important capability will not be a model breaking encryption. It will be a tool-equipped system finding the ordinary engineering mistake that made strong encryption irrelevant. Coldcard owners: determine whether your seed is affectedExposure depends on the device and firmware that originally generated the seed, not the firmware currently installed and not the wallet application now holding it. Moving the same recovery phrase into another brand of hardware wallet does not repair it. The weakness travels with the seed. According toCoinkite’s August 1 advisory, the affected and fixed versions are:|Device and release trackTreat a seed as affected if it was generated onFixed version for generating a replacement seedMk2 or Mk3Version 4. 0. 1 through 4. 1. 9 inclusive4. 2. 0 or laterMk4 or Mk5, StandardAny version before 5. 6. 05. 6. 0 or laterQ, StandardAny version before 1. 5. 0Q1. 5. 0Q or laterMk4 or Mk5, EdgeAny version before 6. 6. 0X6. 6. 0X or laterQ, EdgeAny version before 6. 6. 0QX6. 6. 0QX or laterTAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this specific bug. If you don’t remember which firmware generated the seed, Coinkite’s guidance is to migrate. Do not generate a replacement seed until the correct fixed firmware for your model and release track is installed. What affected owners should do nowThe central instruction is that updating the firmware is not enough. An affected recovery seed must be replaced and the funds moved to addresses controlled by the new seed. Proceed carefully:1. Use only the official Coldcard website and advisory. Do not follow firmware links sent by direct message, email or social-media replies. 2. Confirm that the fixed firmware version for your exact model and Standard or Edge release track is installed. 3. Generate a completely new seed on the updated device. Importing the old words into a different device preserves the vulnerability. 4. Record and verify the new backup offline. Confirm the wallet fingerprint and a receiving address on the Coldcard’s own screen. 5. Send a small test transaction from the old wallet to the verified new address. 6. Restore or open the new wallet, verify its fingerprint and confirm that the test transaction arrived. 7. Move the remaining balance only after the test succeeds. 8. Keep the old backup until the entire transfer is confirmed. Then retire the affected seed permanently. Never type either recovery phrase into a website, support chat or network-connected computer. Coinkite support does not need the words. Anyone offering to “validate,” “protect” or recover a seed through direct messages should be treated as a second attacker targeting frightened victims. Users relying on a strong, unique BIP-39 passphrase have an additional barrier. This means a BIP-39 passphrase, not the device PIN. Short, common, patterned, quoted or reused phrases may still be guessable. Coinkite advises even strong-passphrase users to migrate as soon as practical because the passphrase reduces immediate exposure without repairing the underlying seed. There is one stated exception. If the final seed was created with at least 50 fair, independent and private dice rolls that were never recorded or exposed, Coinkite says the dice supplied at least 128 bits of independent entropy. If there were fewer than 50 roll, or there is any uncertainty, migrate. Multisignature arrangements require separate examination. A wallet is not protected merely because it uses multiple Coldcards. Block says a quorum of secure keys is required. If enough signing keys were generated by affected devices, the multisignature wallet can remain exposed. Large holders should obtain qualified assistance without sharing seed material and should avoid redesigning a complex setup in a panic. If the bitcoin is already gonePreserve the transaction IDs, affected addresses, wallet fingerprint, device model, firmware history, proof of purchase and every communication with Coinkite. Report the theft to the appropriate law-enforcement or cybercrime authority in your jurisdiction and contact Coinkite through its official channel. No third party can reverse a confirmed Bitcoin transaction. Recovery may become possible only if investigators identify the attacker, seize keys or intercept funds at a regulated service. Do not pay anyone who promises guaranteed recovery, and never provide the old seed as “proof” of ownership. Galaxy Research says the tracked proceeds remain unspent as of August 1. That may help investigators monitor them. It doesnt make the transactions reversible or guarantee restitution. The human impact is already visible in first-person accounts: retirement cushions, years of wages and savings accumulated under inflation disappeared in minutes. Many victims appear to have followed the security culture surrounding Bitcoin. They chose self-custody, bought an air-gapped open-source device and kept their recovery words away from the internet. The failure occurred before they wrote those words down. The Coldcard incident shows where the next phase of AI-enabled cybersecurity may emerge. Frontier systems don’t need to defeat our strongest mathematics. They can search every layer surrounding it (dependencies, integrations, build systems, defaults and old commits) until they find the place where a secure design became an insecure product. Primary sources●Coinkite: Coldcard Security Advisory●Coinkite: Technical Deep Dive into the Entropy Issue●Block Engineering: Predictable RNG Fallback and 32-Bit Reseed in Coldcard Firmware●Galaxy Research: Updated on-chain tracking, August 1●Coinkite co-founder Rodolfo Novak: Accountability statement●Jonathan Goodman: X account of his loss●Jonathan Goodman: Detailed LinkedIn account●Reddit: “8 years of stacking, gone”