Coldcard Hardware Wallet Hacked, Losses Exceed $100 Million; Coinkite Says Multiple Frontier AI Models Failed to Find Vulnerability

①Coinkite announced that none of the multiple cutting-edge AI models it used identified the software vulnerability that led to the theft of funds from users of its high-security Coldcard hardware wallet, warning that the incident is significant for all companies doing business in Bitcoin. ②Galaxy Research analysis shows that the Coldcard hack has caused $130 million in losses and the attack is still ongoing. Cailian Press, August 5 (Intern Editor Yang Shuwen / Editor Qi Ling) — Canadian Bitcoin technology company Coinkite issued a new announcement stating that the software vulnerability that recently caused user funds to be stolen was not identified by artificial intelligence tools, and warned that this situation is "a warning to all companies doing business in Bitcoin, not just Coinkite."

In the announcement, Coinkite stated that the company used a series of cutting-edge models, including Kimi K3, Claude Fable and Codex 5.6, in AI-assisted reviews, and none of them found the software vulnerability.

The company also stated that it will continue to update the announcement as its investigation into the incident deepens.

Coinkite's Coldcard hardware wallet is recognized by the crypto market as a high-security hardware "cold wallet," relying on offline, disconnected storage of private keys, and has long been regarded by large Bitcoin holders as a core tool for avoiding coin theft and exchange blowups.

According to the latest analysis by Galaxy Research, the Coldcard hardware wallet hack, including suspected attacks, has caused $130 million in losses. The coin theft attacks are still ongoing.

Overview of the Coldcard incident

Last Thursday (July 30) marked the beginning of the first round of large-scale coin theft, with attackers emptying 1,195 addresses in 41 minutes and stealing 1,082.65 bitcoins. Coinkite immediately issued a security warning.

Last Friday, Coinkite CEO Rodolfo Novak apologized on social media, saying that "the company takes full responsibility for the firmware error." The company has not yet disclosed a specific compensation plan.

In the company's last security announcement update on August 1, Coinkite stated that it had released emergency fixes for all affected models and versions.

In addition, according to cryptocurrency experts and Coinkite's description, the attack process was as follows: an algorithmic flaw in the "mnemonic Seed phrase" (a long string of words used to access the wallet) helped attackers derive the wallet's location, then by comparing the public blockchain they found where the assets were stored, obtained the private keys and transferred the coins away.

It is worth noting that the affected firmware versions Mk2/Mk3 were initially released in March 2021, and from 4.0.1 to 4.1.9 there was a persistent compilation configuration error: the hardware true random number generator was silently bypassed, and a predictable software pseudo-random number generator was used instead to generate mnemonics.

Market reaction

The hack and coin theft incident triggered a series of panics on social media, and also made many people realize that "self-custody" is one of the founding principles of cryptocurrency.

Nikhil Raghuveera, CEO of blockchain startup Predicate, said, "Self-custody is a core characteristic of digital assets, but the Coldcard incident shows that a single point of failure is enough to undermine the credibility of the entire model, because the ecosystem is built on promises that lack trust."

Vincent Bouzon, a cybersecurity expert at competitor Ledger, commented that the root key security of any wallet ultimately depends on a high-quality random number (entropy) generation process, and entropy generation must rely on secure hardware and must not silently degrade at the architectural level to untrusted software randomness.