Last updated on August 2nd, 2026 at 06:02 pm
A five-year-old firmware error made supposedly secure Bitcoin wallet seeds searchable. The manufacturer suspects AI found the flaw. There is no evidence yet, but the implications are enormous, and affected Coldcard owners need to move now.
UPDATE 8/3
The figures above have been overtaken. Galaxy Research has now mapped a third wave, bringing observed losses to roughly 1,367 BTC, about $88.6 million, from 4,585 addresses.
Wave three ran from 12:23 UTC on July 31 to 06:42 UTC on August 1, across blocks 960,396 to 960,471, taking 207.73 BTC from 1,912 addresses. Galaxy says waves one and two may share an operator based on their transaction patterns, and that wave three should not be assumed to involve the same attacker. It repeats that its work is on-chain analysis and that it has not computationally confirmed every identified address came from a weak Coldcard seed. It has passed roughly 600 suspected attacker addresses to federal investigators, compliance firms and cybersecurity investigators.
Wave three also changed shape. The proceeds went into 293 separate P2WSH vaults rather than the handful of collector addresses used earlier, which makes the funds harder to group from the outside. Galaxy reads that as either the original attacker rebuilding after the first sweeps became public, or a second party working the same pool of vulnerable addresses.
No balance is small enough now
Goodman (see below) lost 18.25 BTC. The median address in wave three gave up 0.013 BTC. Of the 4,585 drained addresses, 3,122 lost under 0.1 BTC. The 288 addresses holding more than 1 BTC account for around 960 BTC of the total, and the largest single address gave up 51.07 BTC. The median victim address had sat untouched for about three and a half years, which is what long-term cold storage looks like.
The falling average haul means the profitable end of the vulnerable key space is picked over and the scanner has moved down-market. Galaxy’s Alex Thorn has said every single-signature Coldcard address created after the March 2021 firmware release will eventually be drained. Anyone waiting to find out whether their wallet is small enough to be overlooked has the timeline backwards.
One measurable consequence: exchange deposits spiked on July 31, with net inflows of about 11,163 BTC, as holders moved coins back onto the platforms that a decade of self-custody advocacy told them to leave.
Whether this counts as carelessness
Chris Masterjohn’s post calling the failure total carelessness and a total lack of due diligence driven by utter pettiness has generated 346,000 views. He describes a coder disabling the built-in random number generator, redirecting to a different one, and missing that the C layer underneath called the disabled generator back in. He says the divergence from the open source happened out of spite after a competitor shipped a product built on Coinkite’s code. He owns two Coldcards, never used them, and says he will never touch the company again.
That mechanism is inverted from what the code shows. Nothing reached around anything. MICROPY_HW_ENABLE_RNG was defined and set to zero, the guard tested only for existence, the two functions had compatible signatures, and the build linked the software fallback and reported success.
The distinction matters; a guard that tests whether a setting exists instead of what it equals is an old and well-populated category of C mistake. A deterministic generator passes every statistical test for randomness, so the seed words looked correct on the screen and correct under inspection. The repository was public for five years, and the reviewers who read it missed it too.
Entropy generation is the one function in this product where silent failure costs the owner everything, and nothing in the build asserted that the shipped binary had actually linked the hardware generator. A symbol check finds this. A reproducible build diff finds this. Neither requires anyone to have anticipated this particular error. That check was absent across five years and several product launches.
On the pettiness: Coinkite did tighten its license after a competitor built on its code. Tying that history to this commit is Masterjohn’s inference, and the post does not show the work. Dustin Dettmer’s walk through the firmware commit history, which is what Masterjohn was responding to, is the better source on what changed and when.
Both explanations now circulating point away from the same place. Coinkite says it has to assume an attacker used AI on old firmware. Masterjohn says one coder did not understand C. A missing build assertion sits underneath both.
Galaxy on LLM orchestration
Thorn has separately described the sweeps as deliberate and likely LLM-orchestrated. That goes further than the position taken above, which is that exploitation ran on conventional computing. Galaxy has published no evidence for the orchestration claim, and on-chain records show timing, batching and address selection rather than the tooling behind them. It stands as a second informed hypothesis about AI involvement, still unproved, from the firm with the clearest current view of the transaction record.
“Eight years of stacking, gone.” (Original post)
That was the headline of a devastating post on the Bitcoin subreddit this weekend. The writer, 39, said two bitcoin accumulated over eight years had been drained from a Coldcard wallet. The money was supposed to provide a financial cushion before 50. The owner had chosen Bitcoin as protection against sanctions, inflation and a weak national currency, then stored it on a device widely praised as one of the most secure hardware wallets available.
An even larger first-person account has come from Toronto-born author and entrepreneur Jonathan Goodman. Goodman wrote on X and in a longer LinkedIn post that 18.25245043 BTC disappeared from his wallets between 9:36 p.m. and 9:43 p.m. on July 29. He valued the loss at just over $1.6 million—a figure consistent with Canadian dollars at the time, although his post does not specify the currency.
Goodman said his keys were held on a Coldcard in a safety-deposit box, the device had never connected to the internet and he had never shared his seed phrase. He learned what had happened after opening Wasabi to view the wallets and seeing the withdrawals. “I did everything right,” he wrote. Goodman said he was filing reports with police and the Ontario Securities Commission, while expecting that the money would not be recovered.
His loss and the Reddit account are self-reported and have not been independently verified through transaction details published with the posts. Their timing and descriptions are consistent with the known incident. The mass theft surrounding them has been established on-chain.
Goodman describes hackers using AI to brute-force seed phrases. That’s his understanding of the attack, not separate evidence of AI involvement. The public record establishes weakened seed generation and automated theft; it does not reveal which tools found the vulnerability.
As of August 1, Galaxy Research says it is tracking two waves involving 1,158.81 BTC, worth an amount ranging from US$75 million to $88 million, taken from 2,673 Bitcoin addresses and held across seven attacker addresses. The addresses do not represent 2,673 individual people; one wallet and one person can control many addresses. The expanding count does show that the original estimate, 594 BTC from roughly 500 addresses, captured only part of the event.
The victims did not necessarily expose recovery phrases, connect devices to the internet or fall for phishing. A firmware error may have made the phrases guessable from the day they were created.
Coldcard manufacturer Coinkite now says AI may have discovered the error. That claim remains speculation. Its plausibility however is what makes the incident much larger than a cryptocurrency story, and possibly tied into other widely reported AI stories of the past several months.
What actually failed
A hardware wallet does not hold bitcoin. The bitcoin remains recorded on the blockchain. The device holds the private keys that authorize its movement.
Those keys normally begin with a recovery seed generated from enough randomness to make guessing it effectively impossible. A standard 12-word seed targets 128 bits of entropy: a search space so large that brute force is not considered a realistic attack. Coldcard’s firmware failed at that foundational step.
In March 2021, Coinkite changed the path used to generate wallet seeds. The firmware was meant to call the device’s hardware random-number generator. A build and integration error instead routed the request to a deterministic software fallback inherited from MicroPython, according to the technical investigation by Block’s Bitcoin Engineering and Security teams.
The mistake was extremely small. One component checked whether a setting called MICROPY_HW_ENABLE_RNG existed. It did exist, but its value was zero. The check passed anyway. Two random-number functions had compatible signatures, the build completed without an error, and the wallet displayed perfectly normal seed words. The words were valid, but insufficiently random.
Coinkite estimates that affected Mk2 and Mk3 seeds may have had about 40 bits of effective security. Later Mk4, Mk5 and Q devices mixed in additional secure-element data, raising the estimate to roughly 72 bits: materially better, still far below the intended 128.
Forty bits is approximately 1.1 trillion possibilities. That doesn’t mean every affected seed can be recovered instantly. Block’s Bitcoin Engineering and Security teams caution that the practical cost also depends on constraining the device identifier, boot timing, previous calls to the generator and address-derivation work. The active theft demonstrates that at least one attacker learned enough to make the search operational.
Once the attacker had a workable candidate-generation process, the public blockchain supplied the verification layer. Candidate seeds could be turned into addresses and compared with addresses containing bitcoin. A match produced the corresponding private key. The attacker could then sign an ordinary transaction and empty the address without touching the physical device.
To the Bitcoin network, that signature was valid. There was no unauthorized login to flag and no transaction for a bank to reverse. The distinction between a stolen key and a legitimately used key does not exist at the protocol level.
Bitcoin’s cryptography was not cracked. The product responsible for creating the keys made them searchable.
Did AI find the flaw?
Coinkite’s technical account says its source code has always been publicly available, so the company “has to assume” someone used AI to examine previous firmware and find the issue.
It also discloses an extraordinary detail: several weeks before the theft, Coinkite gave its code to what it describes as one of the best available AI models for a security review. The model found nothing serious.
There is currently no public evidence identifying the attacker, the discovery process or the tools used. Blockchain analysis can reveal transaction patterns and movements. It cannot reveal whether a human researcher, an AI coding agent or a mixed team found the vulnerability.
The company’s statement should therefore be read as a hypothesis, not attribution. Coinkite co-founder Rodolfo Novak has separately said the company takes full accountability for the firmware bug and apologized to users.
AI is also a convenient frame for Coinkite. It moves attention from the absence of end-to-end verification toward an unknowable attacker capability. The company has accepted responsibility; its AI theory still should not be repeated as fact.
The possible role of AI can be divided into three parts:
1. Creating the vulnerability: This was a conventional software integration error introduced by humans in 2021.
2. Discovering the vulnerability: AI may have accelerated examination of the open-source code and its history. This is plausible and unproved.
3. Exploiting the vulnerability: Once understood, the attack required optimized candidate generation, blockchain matching and automated transaction signing. Those are conventional computing tasks. Generative AI was not required to execute them.
The strongest formulation supported by the evidence is that AI may have helped an attacker discover and operationalize a five-year-old bug. Cybernews reports Coinkite ran one of the best available AI models over their own code a few weeks earlier and it found neither this bug nor anything serious.
Why the AI theory is plausible
This is the kind of error modern coding agents are becoming unusually good at finding. It crossed repository boundaries, dependency code, build configuration and end-to-end call resolution. A surface reading showed that the intended hardware generator existed in the firmware. The failure became visible only by tracing which implementation wallet generation actually reached after compilation.
A model in a chat window can miss that. An agentic system with access to the entire repository, Git history, dependency versions, a build environment, call-graph tools, test harnesses and repeated execution has a much better chance.
That is the scaffolding distinction. The model is one component. The surrounding system turns code comprehension into a vulnerability-discovery pipeline.
Open source remains essential to security because defenders can inspect and reproduce the code. It also makes the complete history available to attackers. AI changes the cost and scale of that inspection. Every abandoned branch, inherited dependency, stale build flag and forgotten security assumption can now be examined repeatedly by machines that do not become bored.
The asymmetry is brutal. A defender has to find every consequential error before release and continue finding them across every update. An attacker needs one overlooked error attached to enough money.
Coinkite’s own failed AI review adds another warning. Simply running code through AI is not a security control. Results depend on the model, context supplied, tools, tests, prompts, iteration and whether the system can verify the behavior of the compiled product rather than comment on source files in isolation.
If AI involvement is confirmed, the Coldcard attack will be remembered as an early example of AI changing vulnerability economics. The important capability will not be a model breaking encryption. It will be a tool-equipped system finding the ordinary engineering mistake that made strong encryption irrelevant.
Coldcard owners: determine whether your seed is affected
Exposure depends on the device and firmware that originally generated the seed, not the firmware currently installed and not the wallet application now holding it. Moving the same recovery phrase into another brand of hardware wallet does not repair it. The weakness travels with the seed.
According to Coinkite’s August 1 advisory, the affected and fixed versions are:
|
| Device and release track | Treat a seed as affected if it was generated on | Fixed version for generating a replacement seed |
| Mk2 or Mk3 | Version 4.0.1 through 4.1.9 inclusive | 4.2.0 or later |
| Mk4 or Mk5, Standard | Any version before 5.6.0 | 5.6.0 or later |
| Q, Standard | Any version before 1.5.0Q | 1.5.0Q or later |
| Mk4 or Mk5, Edge | Any version before 6.6.0X | 6.6.0X or later |
| Q, Edge | Any version before 6.6.0QX | 6.6.0QX or later |
TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this specific bug.
If you don’t remember which firmware generated the seed, Coinkite’s guidance is to migrate. Do not generate a replacement seed until the correct fixed firmware for your model and release track is installed.
What affected owners should do now
The central instruction is that updating the firmware is not enough. An affected recovery seed must be replaced and the funds moved to addresses controlled by the new seed.
Proceed carefully:
1. Use only the official Coldcard website and advisory. Do not follow firmware links sent by direct message, email or social-media replies.
2. Confirm that the fixed firmware version for your exact model and Standard or Edge release track is installed.
3. Generate a completely new seed on the updated device. Importing the old words into a different device preserves the vulnerability.
4. Record and verify the new backup offline. Confirm the wallet fingerprint and a receiving address on the Coldcard’s own screen.
5. Send a small test transaction from the old wallet to the verified new address.
6. Restore or open the new wallet, verify its fingerprint and confirm that the test transaction arrived.
7. Move the remaining balance only after the test succeeds.
8. Keep the old backup until the entire transfer is confirmed. Then retire the affected seed permanently.
Never type either recovery phrase into a website, support chat or network-connected computer. Coinkite support does not need the words. Anyone offering to “validate,” “protect” or recover a seed through direct messages should be treated as a second attacker targeting frightened victims.
Users relying on a strong, unique BIP-39 passphrase have an additional barrier. This means a BIP-39 passphrase, not the device PIN. Short, common, patterned, quoted or reused phrases may still be guessable. Coinkite advises even strong-passphrase users to migrate as soon as practical because the passphrase reduces immediate exposure without repairing the underlying seed.
There is one stated exception. If the final seed was created with at least 50 fair, independent and private dice rolls that were never recorded or exposed, Coinkite says the dice supplied at least 128 bits of independent entropy. If there were fewer than 50 roll, or there is any uncertainty, migrate.
Multisignature arrangements require separate examination. A wallet is not protected merely because it uses multiple Coldcards. Block says a quorum of secure keys is required. If enough signing keys were generated by affected devices, the multisignature wallet can remain exposed. Large holders should obtain qualified assistance without sharing seed material and should avoid redesigning a complex setup in a panic.
If the bitcoin is already gone
Preserve the transaction IDs, affected addresses, wallet fingerprint, device model, firmware history, proof of purchase and every communication with Coinkite. Report the theft to the appropriate law-enforcement or cybercrime authority in your jurisdiction and contact Coinkite through its official channel.
No third party can reverse a confirmed Bitcoin transaction. Recovery may become possible only if investigators identify the attacker, seize keys or intercept funds at a regulated service. Do not pay anyone who promises guaranteed recovery, and never provide the old seed as “proof” of ownership.
Galaxy Research says the tracked proceeds remain unspent as of August 1. That may help investigators monitor them. It doesnt make the transactions reversible or guarantee restitution.
The human impact is already visible in first-person accounts: retirement cushions, years of wages and savings accumulated under inflation disappeared in minutes. Many victims appear to have followed the security culture surrounding Bitcoin. They chose self-custody, bought an air-gapped open-source device and kept their recovery words away from the internet.
The failure occurred before they wrote those words down.
The Coldcard incident shows where the next phase of AI-enabled cybersecurity may emerge. Frontier systems don’t need to defeat our strongest mathematics. They can search every layer surrounding it (dependencies, integrations, build systems, defaults and old commits) until they find the place where a secure design became an insecure product.
Primary sources
● Coinkite: Coldcard Security Advisory
● Coinkite: Technical Deep Dive into the Entropy Issue
● Block Engineering: Predictable RNG Fallback and 32-Bit Reseed in Coldcard Firmware
● Galaxy Research: Updated on-chain tracking, August 1
● Coinkite co-founder Rodolfo Novak: Accountability statement
● Jonathan Goodman: X account of his loss
