IN TODAY'S ISSUE:
- Coldcard hardware wallets from Coinkite were subject to an exploit that cost affected users $130M in funds. Insufficient randomness generated by the wallets allowed an attacker to generate private keys and move funds. The Bitcoin protocol was not affected.
- The episode has tested two core philosophies of the community – self storage and cold storage. This episode may push investors to regulated custodians or financial products, which operate under more stringent measures, but is unlikely to eliminate the practice of self custody.
- AI is increasingly at the center of the security race, but AI’s role in discovering the flaw remains unproven, while Coinkite’s AI-assisted reviews failed to detect it, reinforcing the need for independent audits, end-to-end testing, and human oversight.
- The incident has increased scrutiny of seed generation, firmware testing, software integration, and custody diligence, creating an opportunity for higher standards and more resilient security architectures across the industry.
Coldcard, Self-Custody, AI, and the New Security Arms Race
The news that has dominated headlines this past week has been the hack of Coldcard, which has thus far drained $130M from user wallets. Coldcard is a hardware wallet offered from Canadian Bitcoin security device manufacturer Coinkite, which was founded in 2012. In addition to the heart-breaking financial losses suffered by Coldcard users, the events have shaken some of the core tenets of the industry, such as self-custody and cold storage, and highlighted the growing impact of AI on software security.
What Happened
Readers should first understand that the vulnerability did not affect the Bitcoin protocol, its consensus rules, or its underlying cryptography. The failure occurred with Coldcard’s wallet firmware. A software integration introduced in March 2021 caused affected devices to route seed generation to a deterministic software-based random-number generator instead of the intended hardware source. Under Coinkite’s preliminary analysis, the defect reduced the effective search space from the expected 128 bits to approximately 40 bits and 72 bits depending on the device.
Loss of Randomness Reduces Security
Because every private key in a wallet is derived from its recovery seed, reducing the seed’s randomness materially reduces the number of possibilities an attacker needs to test. A 128-bit secret has approximately 3.4 × 10³⁸ possible values, compared with approximately 4.7 × 10²¹ at 72 bits and 1.1 × 10¹² at 40 bits. The 40-bit case could therefore become searchable using parallel or specialized computing. Later devices incorporated secure-element randomness, which improved security, but the way that entropy was mixed into the software generator still left Coinkite with a preliminary estimate of approximately 72 bits of effective security.
The software generator also relied primarily on three inputs that could be known, which further reduces the search space for the hacker: part of the device’s fixed chip identifier, a processor counter linked to boot timing, and the device clock’s time and subsecond registers. Once those inputs and the number of earlier random-number calls were established, the generator produced a deterministic sequence. An attacker could therefore model plausible device states offline, derive the Bitcoin addresses associated with each candidate seed, and compare them with a victim’s known address, public key, or extended public key on the blockchain. A matching candidate revealed the private keys and gave the attacker the same spending authority as the owner, without requiring the physical device, an internet connection to the Coldcard, or access to the written seed backup.
How the Attack Likely Worked
- Find the flaw: Affected firmware used a deterministic software generator instead of the intended hardware source.
- Recreate the process: Public firmware allowed the seed-generation logic to be reproduced outside the device.
- Narrow the inputs: Device identifiers, boot timing, clock state, and prior generator calls were constrained enough to test.
- Generate candidate seeds: Plausible device states produced a smaller set of possible recovery seeds.
- Derive addresses and keys: Each candidate seed generated the corresponding private keys and Bitcoin addresses.
- Find a match: Candidate addresses were compared with known or funded addresses on the blockchain.
- Move the bitcoin: A matching seed gave the attacker valid signing authority without access to the physical Coldcard.
Core Community Tenets Tested
Self-Custody. Self-custody is a defining principle of Bitcoin because it allows owners to hold and transfer bitcoin without relying on a bank, exchange, or other financial intermediary. The Coldcard exploit exposed a critical limitation of that principle: removing a financial intermediary does not eliminate third-party dependencies when users still rely on wallet manufacturers, firmware developers, hardware components, software libraries, and their own operational practices.
The incident also demonstrated sophisticated actors can convert a software defect into an irreversible loss of assets. An OKX executive reportedly observed record inflows to centralized exchanges following the exploit, suggesting that some holders temporarily reassessed the relative risks of self-custody and third-party custody. We do not expect the episode to displace self-custody across the Bitcoin ecosystem because control of private keys remains central to the community’s concept of financial sovereignty.
Cold Storage. The exploit also challenged the assumption that cold storage is inherently secure. Air-gapping could not prevent the loss because the wallet’s recovery seed was weak from the moment it was created, meaning the vulnerability existed before the device was ever used to sign a transaction. A firmware update corrected the generation process for new seeds but could not strengthen seeds created under affected firmware, so Coinkite instructed users to install fixed firmware, generate a new seed, and migrate their funds to addresses derived from that seed.
Some users had an independent layer of protection. At least 50 fair, private dice rolls supplied additional randomness during seed creation, while a strong and unique BIP-39 passphrase created a separate wallet that an attacker could not access using the reconstructed seed alone. The broader lesson is that cold storage is only as secure as the process used to generate, protect, and govern the underlying keys.
Institutional Custody Uses a Different Control Framework
One of the byproducts of the Coldcard exploit, as indicated by the OKX comments on inflows, may be a push towards regulated custodians and financial products. While we cannot speak for other custodians, we can say the specific Coldcard bug does not translate to what we do technically at NYDIG. NYDIG’s custody controls are also subject to recurring SOC 1 Type 2 and SOC 2 Type 2 examinations, providing independent oversight and a formal control framework that differs from consumer-grade hardware wallets. In short, NYDIG has a regulated, institutionally governed, and independently examined custody model that provides more layers of prevention, detection, and coordinated remediation than the consumer self-custody model exposed by the Coldcard incident.
The Role of AI
AI’s role in the Coldcard exploit remains undetermined. Coinkite has suggested that an attacker may have used AI to review firmware and identify the vulnerability, but no public evidence has established that AI was used or identified the perpetrator. Even with AI assistance, reproducing and exploiting the flaw likely required specialist knowledge of Bitcoin wallet architecture, firmware behavior, cryptography, and blockchain analysis.
AI also failed to identify the vulnerability in Coinkite’s defensive reviews. The company reported that an AI-assisted review conducted in the weeks before the exploit missed the defect, while subsequent tests using several frontier models produced the same result.
The broader implication is that AI can lower the cost and increase the scale of both offensive and defensive code analysis, but its effectiveness depends on the scope of the review and the tests it is instructed to perform. AI cannot yet replace end-to-end validation, build-system checks, deterministic testing, or specialist human review of security-critical software.
Final Thoughts
Our thoughts are with the Coldcard users who lost funds in this incident. Those affected were taking deliberate steps to protect their bitcoin through self-custody, which makes the losses particularly painful.
Although it is difficult to find a silver lining after losses of this magnitude, the incident can still contribute to a stronger and more resilient industry. The Bitcoin protocol continued to operate as designed, while the exploit has increased scrutiny of wallet testing, seed generation, custody diligence, and software assurance. Each vulnerability that is identified, understood, and removed can raise the standard of protection for the next generation of Bitcoin users and institutions.
