Coinkite Thinks an AI Found the Coldcard Flaw. A Hobbyist Just Reproduced the Discovery in 8 Minutes

What Happened

By Sunday the question hanging over the Coldcard sweeps had shifted from how much to how. Coinkite, the Canadian manufacturer of the Coldcard hardware wallet, said it believes the attacker who drained roughly $88.6 million from weak seeds used artificial intelligence (AI) to examine older versions of its open-source firmware and locate the path where seed generation fell back to a software random number generator (RNG) instead of the device's dedicated hardware chip.

The company also conceded the uncomfortable half of that theory: its own audit of the same code with a leading AI model, run weeks before the theft, surfaced nothing. Bloomberg reported Monday that the attack on what it called Bitcoin's safest hiding place remains ongoing.

The claim got an unplanned demonstration within days. A developer on Reddit pointed Claude Code, Anthropic's coding agent, at the affected firmware and reported that it located the weak-randomness path in about 8 minutes from a single prompt. Coinkite co-founder Rodolfo Novak, known in the industry as NVK, drew the structural conclusion in a long post on X: AI-assisted code review, he wrote, can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts.

Fixed firmware is out for every model (5.6.0 for the Mk4 and Mk5, 1.5.0Q for the Q, 4.2.0 for the Mk3), and the migration guidance from our August 2 coverage is unchanged: a firmware update does not repair an existing seed.

The attacker may or may not have used AI to find the flaw. The next one will not have to wonder whether it works.

An Unproven Claim With a Convenient Shape

Start with what the evidence does not show. Nobody has produced logs, tooling artifacts, or attacker infrastructure demonstrating that AI found this bug. Coinkite's attribution is inference from circumstance: the flaw sat in public code for 5 years, survived human review, and was then exploited with a precomputed target list assembled patiently enough to sweep 4,585 addresses in coordinated waves.

That pattern is consistent with machine-scale code review. It is also consistent with a skilled human who read the 2021 diff carefully, and skeptics in the developer community made exactly that point, arguing the vendor should have caught a silent RNG substitution without help from any frontier model.

The 8-minute reproduction deserves the same calibration. The Reddit developer knew a seed-generation flaw existed and roughly where to look, and searching code for a bug you know is there is a far easier problem than discovering one cold. What the demonstration actually establishes is narrower but still significant: the marginal cost of this class of search has collapsed to a consumer subscription and a lunch break.

Whether or not this attacker used AI, the next one can. A vendor blaming AI is also a vendor with an interest in making a 5-year engineering miss look like an act of nature, and readers should hold both facts at once: the attribution is self-serving, and the capability it describes is real.

The $88 Million Bounty Announcement

The reason this matters beyond Coinkite is the incentive structure it just made legible. Open-source firmware has always traded transparency for scrutiny: anyone can audit the code, and the theory held that defenders' eyeballs would outnumber attackers'. AI-assisted review breaks the symmetry in the attacker's favor, because the 2 sides are not running the same search.

An auditor has to clear every code path to declare a build safe; an attacker needs exactly 1 payable defect. Coinkite's experience is the asymmetry in miniature: the same class of model that found nothing for the defender, whose review has to prove a negative, allegedly succeeded for an attacker who only needed a single positive.

Cheap machine review multiplies attempts on both sides, and the side that needs 1 hit compounds faster.

This series tracks protective mechanisms inverting into attack surfaces, and this is the cleanest example yet: the audit layer itself. Public code, published diffs, and signed release notes exist to protect users, and each is now a minable corpus that tells an attacker exactly what changed and when.

The sweep also functions as an $88.6 million bounty announcement. Every wallet vendor's repository, every patched-versus-unpatched diff, every commit message that mentions fixing a minor entropy issue should be assumed to be running through the same tooling somewhere, as of this writing.

The window between a public disclosure and mass exploitation, already short, should be assumed to be collapsing toward hours.

What This Means for You

The triage for Coldcard holders is unchanged from our August 2 coverage in 'The Coldcard Sweep Hits $88.6 Million, and the 'Not Affected' Models Join the Advisory': Mk3-era seeds are burned, pre-fix Mk4, Mk5, and Q seeds are 56 bits short of spec, and migration to a fresh seed on patched firmware is the durable fix. What the AI angle adds is a posture change for everyone else, whatever hardware you hold.

First, treat update latency as a security parameter. When a vendor ships a security release, the diff is public the same hour, and machine review means the gap between a published patch and a weaponized exploit is now the attacker's favorite window. Updating within days rather than months used to be cautious advice; it is now load-bearing.

Second, reduce what any single vendor's competence can cost you. Supplying your own entropy (50 or more private dice rolls at seed creation), adding a strong BIP-39 passphrase (BIP-39 is the standard that maps seed words to keys), and splitting large balances across a multi-sig quorum built from more than 1 vendor's hardware each cut the blast radius of the next silent flaw.

What the moment does not justify is abandoning key control. The 11,163 BTC that fled to exchanges on July 31 traded a fixable entropy bug for permanent custodial risk: freeze authority, withdrawal halts, and a jurisdictional contact point that did not exist while the coins sat onchain.

AI-accelerated bug hunting raises the stakes on vendor diversity and update discipline inside self-custody; it does not change the math that a custodian is a standing counterparty while private keys under your control are not. The tools that just got cheaper for attackers are getting cheaper for defenders on the same curve, and the vendors that survive this era will be the ones publishing their audits instead of their excuses.

What to Watch

Coinkite has promised a full post-mortem; the test is whether it documents how the 2021 substitution shipped and what evidence, if any, supports the AI attribution beyond inference. Watch whether any tracing or security firm produces artifacts that harden the claim, whether other hardware wallet vendors respond by publishing independent audit results or entropy-verification features, and whether the pattern repeats: a sweep of old, weak seeds on another vendor's stack within the quarter would confirm the bounty has been collected once and is now being chased everywhere.

The stolen 1,367 BTC still has not moved, and the first outbound spend remains the tracing community's tripwire.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.