Nobody broke the wallet. An AI just read the code nobody else had.
A five-year-old randomness bug in a Bitcoin hardware wallet has cost users tens of millions. The vendor’s own theory is that an AI found what its AI audit had missed.
On 30 July, 1,082 BTC, about $70 million, left 1,196 Bitcoin addresses in roughly 41 minutes. Later waves pushed the confirmed total past 1,367 BTC, near $88.6 million across 4,585 addresses, and it is still climbing. Nothing was hacked in the usual sense: no phishing, no malware, no compromised device. The owners did everything right, on a wallet chosen specifically because it was the careful option.
The failure was randomness. A build setting told the device to skip its hardware random number generator, and the supporting library checked only whether that setting existed rather than whether it was switched on. Seed generation quietly fell back to a software generator fed by the chip’s serial number and clock, around 40 bits of entropy instead of 128. The difference is everything: 128 bits is about 3.4 × 10³⁸ possibilities, and 40 bits is roughly a trillion. One is unsearchable. The other is a weekend of compute.
That bug shipped in March 2021 and sat in public, readable source for over five years. Coinkite’s own explanation for why it surfaced now is the part worth your attention: “we have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue.” The company also said it had run one of the best available AI models over its code weeks earlier, and that review did not find it.
If you own a Coldcard, this is the part that matters
More models are affected than the first reports said
Coinkite’s advisory covers Mk2 and Mk3 on firmware 4.0.1 through 4.1.9, Mk4 and Mk5 before standard 5.6.0 (Edge 6.6.0X), and Q before 1.5.0Q (Edge 6.6.0QX). Coverage on 31 July reported that Mk4, Mk5 and Q were unaffected, based on Coinkite’s early analysis; that scope has since widened. What determines exposure is the firmware version in place when the seed was generated, not when you bought the device.
Updating the firmware does not fix an existing seed
This is the single most misunderstood point. In Coinkite’s words, “updating the firmware does not change or repair an existing seed.” A patched device still holds the same guessable key. You have to update, generate a new seed on the updated firmware, verify it, and move the coins across, the update alone leaves you exactly as exposed as before.
Dice rolls and passphrases change the picture
Coinkite states that if you entered at least 50 fair, independent dice rolls that were never recorded or exposed, the resulting seed is not considered at risk from this issue alone. A passphrase that is short, common, patterned, quoted or reused may be guessable and is an immediate risk. Even a strong passphrase warrants migrating as soon as practical.
The total keeps rising because holders haven’t heard yet
The attacker worked richer wallets first, and every affected seed that has not been migrated is still sitting there with a published address and a guessable key. Later waves have been reported at roughly 1,800 BTC across more than 5,200 addresses, though those newer figures rest on thinner sourcing than the earlier ones. This is an ongoing incident, not a closed one.
The open-source bargain was always that many eyes make bugs shallow. In practice, auditing is unpaid and unglamorous, and nobody volunteers to re-read a five-year-old firmware branch that everyone has moved on from. The bug was visible the entire time. The first party with a real incentive to read that code end to end had roughly a hundred million reasons, and the tools to do it without hiring anyone.
The tempting conclusion is that publishing your code is now a liability. It doesn’t hold. The same models that find these flaws can be pointed at them by defenders, and closing your source mainly removes the volunteers, not the attacker, obscurity is a poor defence against something that reads a binary as happily as a repository. The real problem is timing: attackers adopt new capability immediately, while maintainers work through review cycles and release windows. That gap is the risk, and it is widest right now.
The practical read has nothing to do with crypto. Every product depends on open components, and the cost of reading all of them just fell close to zero, for you and for whoever is looking at you. Running current models over your own dependencies and your oldest, least-loved code is now cheap enough that not doing it is a decision. Coinkite’s experience also sets expectations honestly: one pass with a good model missed this. It is a real advantage, not a guarantee.
Questions people ask
- Is Bitcoin itself broken?
- No. The protocol, the cryptography and the network are unaffected. The failure was in how one hardware wallet generated seeds on certain firmware versions, producing private keys with far less randomness than intended. Wallets created with proper entropy remain as secure as before.
- I own a Coldcard, what should I actually do?
- Check Coinkite’s official advisory for your model and the firmware version in use when your seed was created. If you are affected, update the firmware, generate an entirely new seed on the updated device, and transfer your funds to it. Updating without generating a new seed leaves the original vulnerable key in place.
- Did an AI really find the vulnerability?
- Coinkite says it has to assume so, but has stated no proof of how the attacker found it. What is established is that the code was public for over five years without anyone reporting it, that Coinkite’s own AI-assisted review weeks earlier missed it, and that researchers have since shown models can locate the flaw in the public repository quickly.
- Does this mean open source is less secure now?
- It means the assumption that public code is well-examined code is weaker than it looked. Automated review lowers the cost of finding flaws for everyone, so exposed and rarely-audited code carries more risk than it used to, but the same tooling is available to maintainers, and hiding source does not protect against an attacker who can analyse compiled software.
Summarised from owner-supplied French-language commentary, with all figures and technical details checked against primary and press sources. Verified: Coinkite’s official COLDCARD advisory for the affected models, firmware ranges, the statement that updating firmware does not repair an existing seed, and the dice-roll and passphrase guidance; The Hacker News and CoinDesk for the theft figures, timing and the root cause (a build setting that disabled the hardware RNG, with the supporting library checking only whether the macro existed rather than whether it was enabled); and Coinkite’s quoted assumption that AI was used to review old firmware, alongside its acknowledgement that its own AI-assisted review missed the bug. Corrected from the source material: the flaw is not limited to one model, Mk2, Mk3, Mk4, Mk5 and Q are all covered by the advisory at different firmware thresholds, and the confirmed totals are higher than the figures given there. Newer wave totals are labelled above as less firmly sourced. This article is a summary and not security or financial advice; anyone affected should follow Coinkite’s official advisory rather than act on this page.
Trying to work out which AI tools fit your task? Describe the outcome and get a Blueprint: the tools, the prompt, and the steps, with pricing we verified ourselves.