Coldcard Maker Admits AI Code Review Missed the Bug Behind $100M+ Exploit

The company behind one of Bitcoin’s most trusted hardware wallets just admitted the tool meant to catch exactly this kind of bug never flagged it.

Coinkite, the maker of the Coldcard hardware wallet at the center of an ongoing exploit that’s drained well over $100 million in Bitcoin, acknowledged that artificial intelligence-assisted code review failed to detect the firmware flaw that attackers ultimately exploited. The admission adds a pointed new dimension to an already closely watched security incident.

The underlying vulnerability traces back to a 2021 firmware build configuration error that caused affected devices to generate wallet seeds using a weaker software random number generator instead of the device’s dedicated hardware entropy source, a flaw that sat undetected in production for roughly five years before being discovered and exploited.

The specific admission that AI-assisted review missed the bug lands at a moment when AI-powered code auditing tools have been increasingly marketed across the software industry, including security-critical crypto infrastructure, as a meaningful defense against exactly this kind of subtle implementation flaw, making this a notable real-world data point about the current limits of that approach.

Coinkite has previously confirmed the vulnerability, halted shipments of affected units, and destroyed remaining inventory built with the flawed firmware, though the company has not yet detailed a complete remediation plan for existing owners of already-shipped affected devices.

Want to understand how hardware wallets are supposed to generate secure private keys in the first place? Learn more in the Bitcoin Academy.