FULL STORY

Coldcard Wallet Flaw: AI Replicates in 8 Minutes

A five-year flaw in Coldcard hardware wallets led to massive thefts. Security experts demonstrated that AI could replicate the vulnerability in just eight minutes, highlighting an escalating security crisis.

2026-08-02 ~ 2026-08-03 · 2 episodes · 11 posts

Episode 1 · Surge in AI-Driven Hacking Exposes Software Vulnerabilities (2026-08-02, 2 posts)

AI's ability to discover crypto hardware wallet vulnerabilities highlights critical security flaws across traditional software. Experts warn of an impending surge in AI-driven cyberattacks and social engineering, forcing users to reconsider asset self-custody and data privacy.

Episode 2 · Coldcard Vulnerability Leads to ~$90M Theft; Claude Code Reproduces in 8 Minutes (2026-08-02, 9 posts)

A vulnerability in Coldcard hardware wallets, latent for 5 years, has led to significant theft. The flaw stems from firmware failing to enable the hardware random number generator, reducing key entropy from 2^128 to 2^40, allowing offline brute-force attacks. An estimated 1,367.05 BTC ($88.6M) has been stolen across 4,585 addresses. A developer used a single prompt to guide Claude Code, which independently reproduced the vulnerability in 8 minutes, showcasing AI's power in automated code auditing and raising concerns about AI-enabled attacks.

Confirmed

  • Coldcard wallets have an RNG vulnerability: firmware fails to enable hardware RNG, reducing key entropy from 2^128 to 2^40, enabling offline brute-force.
  • The vulnerability has led to theft of 1,367.05 BTC ($88.6M) across 4,585 addresses.
  • A developer guided Claude Code with a single prompt, and the AI tool independently found the vulnerability after 8 minutes of reasoning. Per @新智元, the issue had been missed by multiple official reviews.

Unconfirmed

  • The total stolen amount varies across posts: "nearly $89M", "$90M", and "over $88M". @Patrice notes potential risk or loss has reached $90M; exact figures remain fluid.

Why it matters

  • This case demonstrates the high efficiency of LLMs in automated code security auditing. @Patrice joked that using AI to find such vulnerabilities is like a free lottery ticket with ROI higher than mining.
  • Developer basedjensen points out the incident exposes the original Coldcard team's poor code quality.
  • Security researchers warn that by year-end, such automated attack tools will be significantly more capable, penetrating weaknesses in various hardware devices. Developers like @ChrisGPT and @rickasaurus worry that LLM advancements will drastically lower the barrier to hacking. Additionally, Anthropic and OpenAI have recently disclosed potential threats from AI models in cybersecurity.