The Coldcard Flaw That Broke Bitcoin's Safest Vault - And Why AI Changes Everything Afterward

Hardware wallets are supposed to remove one entire category of risk: the possibility that someone who is not you can compute your private key. No phishing, no malware, no exchange insolvency. Just a piece of hardware that generates a random seed phrase, which becomes a vault door that only you can open.

Early Friday morning, roughly 500 Bitcoin holders discovered that their Coldcard devices had failed at exactly that job - and had been failing quietly since March 2021. Between 01:31 and 01:56 UTC, an attacker swept 594 BTC - about $38 million at the time from around 500 single-signature wallets in 25 minutes. As of Friday, the total taken from Coldcard users appears to have climbed past 1,082 BTC, well over $70 million, as more addresses continued to be drained.

The initial wave was industrial in its efficiency. More than 1,300 individual UTXOs - unspent transaction outputs, the smallest atomic unit of a Bitcoin balance - were moved across 500 transactions inside three blocks, then 562 BTC was consolidated into a single address that has not moved since. Every drained wallet was single-signature. Every one held more than 0.15 BTC. Most had been dormant for years.

The owner of those wallets was not watching. The attacker did not need to be.

The bug that turns randomness into arithmetic

Here's what matters about what happened, because it has nothing to do with phishing, social engineering, or a compromised computer. A Bitcoin seed phrase - the 12 or 24 words that become your private key - is meant to be drawn at random from a pool so vast that guessing is arithmetically hopeless. The entire security model of Bitcoin self-custody rests on that randomness being real.

In affected Coldcard firmware, it was not.

Analysis published by the Bitcoin engineering team at Block, alongside findings from Coldcard maker Coinkite, traced the vulnerability to a build setting that told the device to skip its own hardware random number generator. A check in a supporting library then tested only whether that setting existed, not whether it was actually switched on. With no working hardware source and no error raised, key generation fell through to a basic software substitute, seeded from the device's serial number and its internal clock registers.

Neither of those inputs is secret. The serial number is fixed factory metadata. The clock values are timing state an attacker can narrow down, or simply measure on an identical device they own. The result: a seed that was supposed to be one candidate among 2^128 possibilities became one candidate among roughly 2^40 - about 1.1 trillion. That is still a large number to a person, but it is trivially small for a modern computer cluster.

The flaw was introduced in firmware 4.0.0 on March 1, 2021, and sat in production for nearly five and a half years before someone exploited it. Mk4 and Mk5 devices were not completely safe either - seeds generated on older firmware for those models contained about 72 bits of entropy instead of the intended 128, which Coinkite described as "less severe but still serious."

What Block did - and didn't - do

The competitor framing here is worth a quick correction. Block's engineering team did publish the most detailed public analysis of the vulnerability and helped trace the bug to its 2021 origin commit. They mapped the attack patterns onchain and confirmed the entropy collapse. But as of this writing, Block has not identified the attacker, nor traced the attack to a specific blockchain services provider or individual. The attacker remains anonymous. The story is about the flaw and its structural implication, not about a caught hacker.

The AI question nobody wants to ignore

What makes this different from previous seed-generation failures is that industry experts believe AI was used in the breach. Coldcard co-founder NVK, in a post on X, warned that the underlying dynamic has shifted. NVK wrote:

> "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike."

The Coldcard firmware is open source. That has been a feature - the ability for anyone to audit the code - until AI models capable of reading millions of lines of code and surfacing latent vulnerabilities became cheap and fast enough for anyone with a GPU. The $70 million taken in this attack functions, in effect, as a bounty that is now being paid to hackers auditing every wallet codebase they can find.

I think that is the structural turn that matters more than the $38 million or even the $70 million. It is not that a single wallet got a bug. It is that the cost of finding firmware-level vulnerabilities has collapsed, and the people benefiting from that cost collapse are not the ones who will patch the code.

What this does to the trust model

Coldcard occupies a specific tier in the Bitcoin security hierarchy. It is the wallet that self-proclaimed maximalists - the people who will tell you never to touch an exchange, never to use a mobile wallet, and to hold your Bitcoin for a decade or more - actually trust with multi-six-figure balances. It is designed around the conviction that security is a property of code, not of institutions. When the code fails silently for five years, the philosophical problem is bigger than the financial one.

The incident also shows why multi-signature setups survive failures that kill single-signature wallets. Peter Todd, a Core contributor and cybersecurity engineer, warned of a specific multisig edge case: in a 2-of-3 setup where two Coldcards are compromised, the moment a transaction reveals the hidden multisig script, the attacker can use those two compromised keys to steal the funds. But with tools like MARA's Slipstream private mempool mining service, which keeps transaction details secret until they are already in a block, the window for that attack closes dramatically. Single-signature wallets have no such escape hatch.

Every wallet drained in this incident was single-signature. That is not a coincidence; it is the vulnerability surface that makes the attack economically viable.

The numbers on the board

Bitcoin itself is down 2.9% today, sitting at $62,880. The broader crypto market is trading at a fear and greed reading of 25 - deep in fear territory - and the total market cap has dropped 2.3% in 24 hours. The immediate price reaction has been modest relative to the scale of the theft, which I find revealing. The market has been digesting a much longer decline - Bitcoin is down nearly 28% over the past year and almost 12% over 60 days - so a $70 million wallet exploit, while serious, has not become a standalone shock.

That does not mean the structural shock is small. It means the market is still pricing in a worse macro environment. The wallet crisis is a separate problem that will not resolve itself when Bitcoin rebounds.

What comes next

Coinkite has released fixed firmware - Mk3 on 4.2.0 or later, Mk4 and Mk5 on 5.6.0 or later, and Q on 1.5.0Q or later. But updating firmware does not repair an existing seed. If your seed was generated on vulnerable firmware, the key material is already weak. You need a new wallet, a new seed, and an onchain migration. Users who added dice-roll entropy or a BIP-39 extra passphrase (an optional backup password layered on top of the seed) face substantially lower risk.

The unanswered question is whether this is a one-off - a firmware-specific bug in one manufacturer's code - or the first visible crack in a wider problem. Every major hardware wallet runs firmware. Every firmware has a codebase. And every codebase that is public is now being read by AI models that can find bugs faster than human review can catch them.

The industry's response so far has been the same one it always gives after a wallet breach: move your funds, update your device, consider multisig. All of it is correct. But the underlying assumption that a sufficiently careful developer process can keep ahead of AI-assisted reverse engineering - that assumption is the one this episode actually tests. And the evidence, right now, is not encouraging.

What I'll be watching is whether other wallet vendors start disclosing previously unknown entropy issues once their code is put through the same AI-driven scrutiny. If more follow, this is not a Coldcard story. It is a hardware-wallet story. And it changes the calculus for anyone who has been told that cold storage is the closest thing to a guaranteed Bitcoin vault.