Coldcard Hack: AI Security Failed to Catch a 16M Bitcoin Bug

Key Takeaway

Toronto-based Coinkite — maker of the popular Coldcard Bitcoin hardware wallet — saysAI security monitoring failed to catch the bugthat let attackers drain up to$116 millionin bitcoin from its customers. The breach traces back to a 2021 firmware update that weakened how recovery phrases were generated, and it has become the loudest warning yet that trusting AI to review security-critical code is not enough.

Top 3 News Headlines

• What we know about the ongoing Coldcard hack that's stolen over $100M worth of bitcoin— CBC News, Aug 2026: blockchain intelligence firm Galaxy Research now tallies the loss above $100M US.
• Bitcoin owners rocked by $116 million hack: what we know about the Coldcard exploit— Fortune, Aug 3: the weakness is rooted in a 2021 Coldcard update that changed how the wallet generated its recovery phrase.
• Hacked Canadian bitcoin wallet maker warns AI failed to detect the bug— Financial Post: Coinkite calls it "a warning for every company building Bitcoin hardware and software, not only us."

What Actually Went Wrong

The exploit did not require a private key leak or a phishing attack. According toFortuneandThe Hacker News, the vulnerability sat in a 2021 software update that altered how Coldcard generated its recovery phrase — the series of words used to regenerate a wallet. The change introduced weak, predictable entropy into the seed-generation path, and once attackers reverse-engineered it, they could derive wallets and sweep funds without ever touching the device.

The numbers escalated fast:The Hacker Newsreported roughly $70 million drained in about 41 minutes;Fox Businessput the total near $89 million across more than 1,200 addresses; andGalaxy Research via CBChas since estimated the loss above $100 million. Coinkite has told owners with exposed seeds to generate a new one on patched firmware and move their coins — restoring the old seed to updated firmware carries the weakness forward.

The AI Security Blind Spot

The sharper story for the industry is what Coinkite said aboutwhythe bug survived. The company warned that firms "using AI to monitor security-critical code" were left exposed, and that the flaw was "a warning for every company building Bitcoin hardware and software, not only us," as reported by theFinancial Post.

It is a reality check on the current AI-security hype cycle. Large language models are good at pattern-matching known vulnerability signatures and drafting code review comments, but they are not a substitute for formal verification, entropy testing, or adversarial review of open-source cryptography. A subtle randomness bug — the kind that silently weakens key generation — is precisely the class of flaw that statistical code reviewers miss and that only deterministic, domain-specific checks reliably catch.

The Bigger Picture: An AI Credit Bubble and Bitcoin's Price

The Coldcard news landed the same week that Maelstrom founder Arthur Hayes argued the AI infrastructure boom is acredit bubble— "Lehman, not Apple" — that will force Washington and Beijing to print more money than they did in 2008. His thesis: that flood of liquidity is what bottoms bitcoin and ultimately drives it toward$1 million. He also sees Ethereum reaching $5,000 by the end of 2026.

The two threads connect in an uncomfortable way. On one hand, AI is being sold as the solution to security; on the other, the capital flooding into AI data centers is creating its own systemic risk. The Coldcard incident is a useful, concrete data point: the technology's limits are showing up in real money lost, not just in analyst warnings.

GitHub Repos to Watch

• Coldcard/firmware— the open-source firmware at the center of the exploit. Watching how Coinkite patches and audits this repo in the wake of the hack is the clearest window into how the industry responds.

What to Do Next

1. If you hold Coldcard— update to patched firmware, generate anewrecovery phrase, and move funds off any wallet created with a pre-patch seed. Do not simply restore your old seed.
2. Audit your self-custody assumptions— hardware wallets are not magic; the entropy path and firmware update history matter as much as the device itself.
3. Treat AI code review as a layer, not a gate— for anything security-critical, pair it with deterministic entropy testing, formal verification, and independent human review.

Pulse Summary:A Canadian Bitcoin wallet maker's $100M+ Coldcard breach — rooted in a 2021 entropy bug that AI monitoring failed to catch — is a two-part warning: self-custody depends on firmware and seed generation, and AI is no substitute for rigorous security review of critical code.