In late July, a coordinated attack drained approximately 1,128 bitcoins (BTC) from Coldcard hardware wallets, valued at over $70 million at the time. The wallets targeted were linked by a shared technical weakness in the way their recovery seeds were generated, exposing a critical flaw in Coldcard’s firmware.

The Vulnerability Explained

Coldcard wallets rely on recovery seeds—lists of words that grant access to funds. The security of these seeds depends heavily on their randomness. However, certain Coldcard models, notably Mk3 devices running firmware from March 2021 onwards, generated seeds with only about 40 bits of effective randomness instead of the intended 128 bits. This drastic reduction made brute-force attacks feasible for well-resourced adversaries.

The root cause was a build-time configuration error where a weaker software random number generator was unintentionally used instead of the device’s hardware-based true random number generator. This error went unnoticed in publicly available firmware for over five years.

AI’s Potential Role in Discovery

Coinkite, the manufacturer, suggested that AI-assisted code review may have played a part in how the flaw was found. Since the firmware is open-source and publicly accessible, the company believes attackers or defenders could have used AI to rapidly analyse the codebase and pinpoint the weak randomness path.

Modern AI tools can scan extensive repositories, identify suspicious function relationships, and highlight security assumptions—tasks that traditionally require expert human review. While independent researchers have demonstrated AI’s ability to locate the flaw after it became public knowledge, there is no confirmed evidence that the original attacker used AI.

Industry and Community Perspectives

  • Some security experts caution against overemphasising AI’s role, noting the flaw was a classic software configuration error that conventional audits might have detected earlier.
  • Others acknowledge that while human error created the vulnerability, AI tools may lower the barrier for both attackers and defenders to find and exploit such weaknesses.
  • The incident also raises questions about the limits of open-source security, as public availability alone does not guarantee thorough review or timely detection of subtle defects.

Practical Implications for Users and Businesses

Coldcard users affected by this flaw must generate new recovery seeds using updated firmware and transfer their funds to new wallets. Adding extra entropy during seed creation or using multi-signature wallets can mitigate risks in future.

For businesses and developers, the incident underscores the need for rigorous testing of cryptographic components, continuous code audits, and the integration of AI-assisted review tools as part of security workflows.

Coinkite has issued firmware fixes and is supporting affected users, while also emphasising the evolving landscape where AI tools will increasingly influence software security.

As AI-assisted code analysis becomes more accessible, organisations must balance reliance on traditional engineering practices with the adoption of advanced automation to detect latent vulnerabilities.

For more insights on integrating AI into secure development and business workflows, visit https://jasonjuul.com.

Disclaimer: This article summarises publicly available information and expert opinions as of the publication date. It does not confirm AI involvement in the original attack and does not provide technical or security advice. Readers should consult official sources and security professionals for specific guidance.