Coldcard Vulnerability Leads to ~$90M Theft; Claude Code Reproduces in 8 Minutes

A vulnerability in Coldcard hardware wallets, latent for 5 years, has led to significant theft. The flaw stems from firmware failing to enable the hardware random number generator, reducing key entropy from 2^128 to 2^40, allowing offline brute-force attacks. An estimated 1,367.05 BTC ($88.6M) has been stolen across 4,585 addresses. A developer used a single prompt to guide Claude Code, which independently reproduced the vulnerability in 8 minutes, showcasing AI's power in automated code auditing and raising concerns about AI-enabled attacks.

Confirmed

Coldcard wallets have an RNG vulnerability: firmware fails to enable hardware RNG, reducing key entropy from 2^128 to 2^40, enabling offline brute-force.
The vulnerability has led to theft of 1,367.05 BTC ($88.6M) across 4,585 addresses.
A developer guided Claude Code with a single prompt, and the AI tool independently found the vulnerability after 8 minutes of reasoning. Per @新智元, the issue had been missed by multiple official reviews.

Unconfirmed

The total stolen amount varies across posts: "nearly $89M", "$90M", and "over $88M". @Patrice notes potential risk or loss has reached $90M; exact figures remain fluid.

Why it matters

This case demonstrates the high efficiency of LLMs in automated code security auditing. @Patrice joked that using AI to find such vulnerabilities is like a free lottery ticket with ROI higher than mining.
Developer basedjensen points out the incident exposes the original Coldcard team's poor code quality.
Security researchers warn that by year-end, such automated attack tools will be significantly more capable, penetrating weaknesses in various hardware devices. Developers like @ChrisGPT and @rickasaurus worry that LLM advancements will drastically lower the barrier to hacking. Additionally, Anthropic and OpenAI have recently disclosed potential threats from AI models in cybersecurity.

2026-08-02 ~ 2026-08-03 · 9 related posts

Full story(2 episodes)→

Episode 1: Surge in AI-Driven Hacking Exposes Software Vulnerabilities(2026-08-02, 2 posts)
Episode 2: Coldcard Vulnerability Leads to ~$90M Theft; Claude Code Reproduces in 8 Minutes(2026-08-02, 9 posts)

Primary sources

Coldcard Hack Drains $88.6M in BTC, Sparks Concerns Over LLM Threats — rickasaurus · 2026-08-02 21:14 (UTC+08:00)
Claude Code Spots 5-Year-Old Wallet Flaw in 8 Minutes After $89M Bitcoin Hack — ChrisGPT · 2026-08-03 05:16 (UTC+08:00)
Claude Code Finds COLDCARD Wallet Vulnerability in 8 Minutes — rickasaurus · 2026-08-03 02:48 (UTC+08:00)

[source] Coldcard Hack Drains $88.6M in BTC, Sparks Concerns Over LLM Threats — rickasaurus · 2026-08-02
ColdCard Exploit Risks $90M: Is 'Vibe Coding' Hacks the New Mining? — ___Patrice___ · 2026-08-03
[source] Claude Code Finds COLDCARD Wallet Vulnerability in 8 Minutes — rickasaurus · 2026-08-03
Claude Code Independently Replicates Bitcoin Wallet Vulnerability in 8 Minutes — wen_ragnarok · 2026-08-03
[source] Claude Code Spots 5-Year-Old Wallet Flaw in 8 Minutes After $89M Bitcoin Hack — ChrisGPT · 2026-08-03
Claude Found Wallet Vulnerability in 8 Minutes, Sparking Open-Source AI Risk Fears — AccBalanced · 2026-08-03
Claude Spots 5-Year Hardware Wallet Bug in 8 Mins as AI Escapes Sandboxes — 新智元 · 2026-08-03
Claude Code Spots Bitcoin Wallet Flaw in 8 Mins; CTOs Bet on 20x AI Revenue Jump — nptacek · 2026-08-03
Claude Code Spots COLDCARD Wallet Vulnerability in 8 Minutes — tekbog · 2026-08-03