Coinkite says it has a working theory for how someone found the flaw that just drained an estimated $115 million in Bitcoin from COLDCARD hardware wallets: they suspect an attacker used AI to comb through five-year-old firmware that the company’s own AI security review had already cleared as safe.
That detail sits inside a technical postmortem the company published this week, one of three posts it has put out since Thursday explaining how a wallet built specifically to be “ultra-secure” ended up generating Bitcoin private keys with a fraction of their intended randomness. The loss estimate has climbed with each new disclosure — from roughly $38 million on the day the advisory went out, to $70 million by PeckShield’s monthly hack tally, to the $115 million DeFiLlama now lists against the entry, tagged simply “COLDCARD.”
A Bug Older Than Most of the Wallets It Emptied
Coinkite’s technical write-up traces the root cause back to 2021, when the company migrated COLDCARD’s elliptic-curve code to Bitcoin Core’s own libsecp256k1 library through an embedded MicroPython wrapper called libNgU. Somewhere in that migration, wallet seed generation was quietly rewired from COLDCARD’s own hardware random-number generator to a MicroPython software fallback — a PRNG seeded mostly from device and timing state rather than true hardware entropy.
The company’s own account of the mistake is unusually blunt: a preprocessor guard used #ifndef to check whether a flag was defined at all, rather than checking whether its value was actually non-zero. Coinkite had explicitly set that flag to zero, so the build silently accepted the wrong RNG implementation instead of throwing the compile-time error it was supposed to. Because both the real and fallback random-number functions shared an identical signature, a code review that only confirmed the correct TRNG code existed somewhere in the binary — without tracing which function calls actually reached it at runtime — would not have caught it.
The practical effect: seeds generated on Mk2 and Mk3 firmware between version 4.0.1 (March 2021) and 4.1.9 carry an estimated 40 bits of effective entropy, Coinkite says, instead of the 128 bits a BIP-39 seed is supposed to guarantee. Mk4, Mk5 and Q devices fared somewhat better — roughly 72 bits — because a later hardware revision mixed in some secure-element randomness as a backup source, but still fell far short of the target.
Coinkite’s Own AI Review Missed It First
The line drawing the most attention isn’t the bug itself but Coinkite’s read on how it was found. “The COLDCARD source code has always been open and publicly available,” the company wrote, “so we have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue. A few weeks ago, we used one of the best available AI models to review our code for security issues, and it did not find this bug or anything serious.” Its conclusion: “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.”
The Toll Kept Climbing After the First Alert
Coinkite’s initial advisory landed on X via the @COLDCARDwallet account on July 31 and has since pulled in 3.6 million views. PeckShield put an early number on it that same day: roughly $38 million in stolen $BTC linked to the entropy flaw. By the time PeckShield published its monthly hack roundup on August 1, that figure had grown to about $70 million — enough to rank COLDCARD as the single largest crypto hack of July 2026, ahead of every DeFi exploit that month, and the third-largest crypto theft of the year to date behind the Drift and KelpDAO/LayerZero incidents.
DeFiLlama’s tracker now shows $115 million against the same entry, suggesting the count of drained wallets is still growing as researchers and Coinkite continue combing the affected keyspace for vulnerable seeds. Coinkite has not published its own updated dollar figure independent of these third-party trackers, and its public statements have focused on migration guidance rather than a running loss total.
Not Every COLDCARD Owner Is Exposed
The exposure isn’t universal, and Coinkite has been specific about the carve-outs. A seed is not considered at risk if it was generated with at least 50 independent, private dice rolls added on top of the device’s own randomness, or if the resulting wallet is protected by a strong, unique BIP-39 passphrase that was never reused, recorded insecurely, or entered on an untrusted device. TAPSIGNER, OPENDIME and SATSCARD run entirely different codebases and are confirmed unaffected. Coinkite has shipped hotfixes across every model and release track — version 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and matching Edge builds — but is explicit that updating firmware does not repair a seed already generated on vulnerable code; anyone who doesn’t qualify for one of the exceptions has to generate a fresh seed and migrate funds manually.
“Trust That Took Years to Build, Broken”
Coinkite’s Sunday follow-up post reads less like a typical corporate incident update and more like a company absorbing the scale of what happened in real time. “The last three days have been some of the hardest in this company’s history,” it opens, “and for a lot of the people reading this, they’ve been something much worse. Money that took years to save, gone. Trust that took years to build, broken. That impact is real, and for some, the damage is permanent.”
The company says it has destroyed its remaining COLDCARD inventory manufactured with the vulnerable firmware and halted shipments once the flaw was confirmed, is working with customers directly to move funds still considered safe, and says its legal team will coordinate with law enforcement across multiple jurisdictions. Notably, Coinkite is telling affected users who need a device sooner than it can supply one to consider competitors — Bitkey, Ledger, Trezor, Jade and BitBox are named directly — rather than waiting on new COLDCARD stock.
Bitcoin’s Price Didn’t Blink
For a flaw specific to how one hardware wallet vendor generated private keys, there was never a reason to expect a network-wide reaction, and Bitcoin’s own chart confirms that read: BTC has traded in a roughly $60,000–$65,000 band through the entire disclosure window, with no visible dip tied to either the July 30 advisory or the climbing loss estimates that followed.
That’s the split this story leaves behind: Bitcoin itself worked exactly as designed, while one popular way of generating the keys that control it quietly didn’t, for roughly five years, until it cost people who had already done everything conventional wisdom told them to do — buy a dedicated air-gapped hardware wallet instead of trusting an exchange or a hot wallet — the thing self-custody is supposed to prevent.
Coinkite’s full advisory, including step-by-step migration instructions for every affected model, remains the authoritative source for anyone who owns a COLDCARD and hasn’t checked whether their seed falls inside the affected window.
