Nearly $89 million in bitcoin disappeared on Thursday, July 30, from thousands of addresses tied to users of Coinkite's Coldcard hardware wallet, according to the wallet maker's technical blog post. The theft did not involve breaking Bitcoin's underlying cryptography or remotely penetrating an air-gapped device. Attackers exploited a software defect that narrowed the randomness used to generate wallet seeds, reducing the keyspace enough to make private keys searchable offline.

What did the attacker actually break?

Coinkite, the Toronto-based manufacturer of Coldcard, said the flaw originated in a 2021 software migration. During the integration, seed generation was rerouted from the device's hardware random-number generator to a software fallback inside a MicroPython component. The cryptographic library itself remained intact.

"The cryptographic library itself was sound. The integration was not," Coinkite wrote in its technical backgrounder.

That routing error reduced the effective entropy of generated seeds. Instead of facing a full 256-bit keyspace, an attacker scanning through candidate private keys could concentrate effort on a much smaller, tractable neighborhood. Funds that should have been statistically invisible became findable on commodity hardware.

How did AI change the economics?

Coinkite wrote on July 30 that, because the Coldcard source code is publicly available, the company is "assuming someone used frontier AI to review older firmware and uncover the issue." Open-source publication gave a model enough material to inspect dependencies, compare intended behavior with implementation, and propose testable defects.

The economics of code review have shifted. Static audits that pass today can become porous when frontier models compress the time required to find obscure interactions among cryptographic libraries, embedded firmware, and random-number generation. An AI coding agent can run that process across thousands of repositories without rest or salary.

The disclosure landed the same week OpenAI confirmed additional instances of its autonomous AI agents breaking containment during an evaluation tied to Hugging Face, underscoring how model-assisted offensive research now competes with defensive review cycles.

What does this change for custody teams?

Three operational consequences follow for banks, custodians, and wallet providers.

• Audit cycles must shorten. Code certified in 2021 sat unexamined for five years before a frontier model surfaced a defect.
• Firmware, MicroPython components, random-number paths, and build configurations need treatment as living attack surfaces, not components trusted indefinitely after a single review.
• On-chain monitoring of funds leaving known vulnerable derivation paths should now sit on every custody team's checklist.

The April edition of PYMNTS Intelligence's "The Enterprise AI Benchmark Report" found that 71% of executives at companies with at least $1 billion in annual revenue view organizational readiness, not AI capability, as the chief limitation on performance. Coldcard's incident makes that readiness gap concrete.

What comes next for cold-storage security?

Coinkite has not said whether reimbursement is contemplated and declined to specify the scope of affected firmware versions beyond its published firmware checks. Affected users can verify wallet status against the company's current signed releases.

The episode puts hardware-wallet entropy generation directly on the supervisory agenda for custody providers in the United States and European Union. Standards bodies that certify random-number paths will face pressure to demand continuous assurance rather than point-in-time audits.

Professor Scott Aaronson, scientific adviser at StarkWare, told PYMNTS in February: "The time to start thinking about migrating to quantum-resistant methods of encryption is now." Coldcard's customers learned the same lesson with bitcoin, not a textbook.