A coding bug in certain Coldcard hardware wallets may have helped attackers steal nearly $89 million in bitcoin. Coldcard maker Coinkite suspects artificial intelligence was used to spot the flaw in its public codebase, though it has offered no proof.
Blockchain analysts at Galaxy Research link three attack waves to 4,585 Bitcoin addresses likely created with vulnerable Coldcard devices. In total, about 1,367 bitcoin were taken. The attack didn’t target Bitcoin itself, but predictable private keys generated by a firmware mistake on Coldcard.
What went wrong with Coldcard wallets?
Coldcard’s firmware used less randomness than users should expect when creating new wallets. As a result, some recovery phrases came from a much smaller pool of possible combinations.
Normally, a hardware wallet creates a recovery phrase—also known as a seed phrase—using cryptographically secure randomness. That word sequence underpins the private keys that let a user spend their bitcoin.
Coldcard’s trouble began with a March 2021 change. The software switched to a cryptographic library accessed via the MicroPython language. Due to an integration error, requests for random numbers fell back to a predictable software-based fallback instead of the device’s hardware random generator.
Coinkite’s technical analysis says the cryptographic library itself wasn’t the issue. The flaw arose from how Coldcard integrated it into the firmware, causing a random data function to point to the wrong implementation.
Block, the company behind the Bitkey wallet, reached a similar conclusion in a separate review. According to Block’s analysis, the vulnerable path existed from March 2021 onward. Later devices added extra randomness sources, but still didn’t always meet the intended security level.
Why were recovery phrases predictable?
The recovery phrases looked normal but contained far less entropy than intended. Entropy is the measure of unpredictability.
A recovery phrase with 128 bits of true entropy has about 2 to the power of 128 possible outcomes—so many that brute-forcing them is practically impossible.
On vulnerable Coldcard Mk2 and Mk3 devices, Coinkite estimates effective security dropped to roughly 40 bits—around 1.1 trillion possibilities. That’s a lot, but not out of reach for an attacker with optimized software, specialized hardware, and extra device context.
For newer models—including the Mk4, Mk5, and Coldcard Q—Coinkite estimates about 72 bits of effective entropy. That’s far better than 40 bits but still below the intended 128-bit level.
How were wallets drained?
The attacker could reconstruct likely recovery phrases offline, then derive Bitcoin addresses from them. The public blockchain then made it easy to check which candidate wallets actually held funds.
A typical attack likely followed four steps:
- Generate large batches of plausible recovery phrases.
- Derive private keys and Bitcoin addresses from each phrase.
- Match those addresses against the public blockchain.
- When there’s a hit, move the bitcoin using the reconstructed private key.
The Coldcard didn’t need to be online, and the attacker didn’t need the physical device.
That’s why the air-gapped design offered no protection. Air-gapped wallets keep private keys off internet-connected machines—but that doesn’t help if the key is predictable from the start.
Bitcoin itself wasn’t broken. The network’s cryptography remained intact. The weakness lay in how one device generated secret keys.
How big are the losses?
According to CoinDesk, Galaxy Research identified three attack waves that drained about 1,367 bitcoin from 4,585 addresses—worth roughly $88.6 million at the time.
The first widely reported wave hit around 594 bitcoin across roughly five hundred wallets, with the transactions executed in under 30 minutes. Later waves targeted smaller balances too, pushing losses higher.
These figures come from on-chain analysis. Researchers spot patterns in addresses, transactions, and how stolen funds are consolidated. Not every affected address can be cryptographically proven to originate from a vulnerable Coldcard.
Did AI enable the Coldcard hack?
There’s no evidence the original attacker used artificial intelligence. Coinkite frames AI involvement as an assumption, not an established cause.
The company argues that Coldcard’s source code was public, so an attacker could have combed through historical firmware with AI. Coinkite even suggests AI may have helped the attacker, while a prior AI review by the company missed the flaw.
That claim overreaches the facts. No perpetrator has been identified, and no details about the model, prompts, or development tools used in the original research have been published.
The accurate journalistic conclusion: AI might have sped up discovery of the bug, but there’s no proof it was used in the attack.
Could an AI model actually find the bug?
Modern coding agents proved capable of flagging the vulnerability quickly after disclosure. One Reddit user reported that Claude Code, given a general prompt to scan the firmware for issues, surfaced the problem in about eight minutes.
Another user said an offline local model without internet access flagged the same weak random number generator. These experiments show AI systems can spot the flaw in source code—but they don’t prove the attacker used the same method. And these tests ran after specifics of the vulnerability were already public.
That distinction matters. A model tested later can latch onto information already circulating in forums, articles, or its own context. A fully controlled test would require a model without recent data access, an exact copy of the historical code, and a documented prompt.
Why did an earlier AI audit miss it?
An earlier Claude Code audit explicitly checked Coldcard’s firmware for weak randomness but wrongly judged the suspect code as safe. The audit lacked all necessary source files.
A later reconstruction showed two relevant submodules weren’t loaded. The AI only saw part of the implementation and treated the missing pieces as if they disproved a potential weakness.
The audit also accepted a code comment as evidence that a function delivered high-quality hardware randomness. The model didn’t fully trace the function through build-time dependencies and settings—precisely where the flaw lived.
This failed audit exposes a core problem: an AI can analyze code convincingly without realizing critical files are missing. The conclusions can sound more certain than the evidence supports.
Was the theft itself an AI attack?
The actual theft likely didn’t need generative AI. Traditional software is better suited for large-scale key guessing and automatically firing off Bitcoin transactions.
The rapid transaction bursts and similar fees point to a prebuilt, automated attack toolkit. Automation, however, isn’t the same as artificial intelligence.
AI would have been most useful in the discovery phase:
- scanning source code and historical firmware versions;
- prioritizing suspect security functions;
- tracing relationships across software modules;
- proposing potential exploits and test code.
The actual brute-forcing could then run on optimized programs, GPUs, or specialized compute infrastructure.
What does the Coldcard case reveal about AI and cybersecurity?
The Coldcard case shows AI can cut the cost of security research. A single person with a coding agent can sift public codebases faster and highlight likely weak spots.
That edge applies to both defenders and attackers. An attacker no longer needs to deeply understand every part of a codebase before finding promising bugs. An AI agent can act as a scalable tool that continuously hunts for weaknesses.
For defenders, the risk is false confidence. A report where an AI model finds no major issues doesn’t prove the software is safe. Missing files, bad assumptions, and incomplete build configs can quietly derail the analysis.
The key takeaway isn’t that AI hacked Coldcard. It’s that AI accelerates security research—but it doesn’t replace human oversight, reproducible testing, or traditional code audits.
What should potentially affected users do?
A firmware update won’t fix a recovery phrase generated with weak randomness. Users should create a brand-new wallet with a new seed and move their bitcoin to fresh addresses.
Coinkite lists Coldcard Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 as affected. Version 4.2.0 fixed the creation of new seeds on these devices. Other models and firmware versions carry separate risks because the amount of available entropy differs.
Re-importing the same old recovery phrase on an updated device does not fix the issue. The weak private keys remain in place.
Users should check Coinkite’s official security notices and never enter a recovery phrase on websites claiming to “test” wallets. A legitimate check never requires sharing your full seed phrase online.
Conclusion
AI didn’t crack Coldcard, and Bitcoin itself wasn’t hacked. A firmware bug caused some devices to generate predictable recovery phrases, letting attackers reconstruct possible keys and drain wallets.
AI may have helped the attacker spot the flaw in public source code. So far, no proof of that has been published.
What is clear: modern AI tools could quickly flag the bug in hindsight—yet an earlier AI audit missed it entirely. That contrast is the point of the Coldcard case: AI can accelerate security research, but with equal confidence can produce an incomplete or wrong conclusion.
SEO overview
SEO title: Coldcard hack cost nearly $89 million: did AI find the fatal flaw?
Meta description: A bug in Coldcard wallets made recovery phrases predictable. Attackers may have stolen 1,367 bitcoin. What role did AI play in the hack?
Focus keyphrase: Coldcard hack AI
Secondary keywords: Coldcard vulnerability, Coldcard firmware bug, AI cybersecurity, bitcoin hardware wallet hack, predictable seed phrase
Suggested slug: coldcard-hack-ai-bitcoin-wallet
Discover title alternative: AI didn’t crack Coldcard—but it may have helped the attacker
Featured image: 1280 x 720 pixels, no text or logos. Show a Coldcard-like hardware device beside a damaged digital lock, with abstract AI code and Bitcoin transaction lines in the background. Use a dark, journalistic style with orange and cool blue accents.
Publication checklist
- The key news fact appears in the first paragraph.
- The article makes clear that Bitcoin itself was not hacked.
- Facts and unproven AI claims are strictly separated.
- Technical terms like entropy and seed phrase are explained.
- Damage estimates include context and nuance.
- AI’s role is covered from both offensive and defensive angles.
- Users receive concrete security guidance.
- No unfounded attribution to Claude or any other model.
- Structure is optimized for mobile, Google Discover, and AI Overviews.
Loading