Hardware wallet manufacturer Coinkite has pushed out a new firmware update for its Coldcard line following a devastating security incident in which attackers drained more than $114 million in bitcoin from user funds. The company said the vulnerability stemmed from a randomness flaw that affected seed generation, allowing attackers to predict private keys under certain conditions. While the firmware patch addresses several underlying problems, Coinkite stressed that simply updating the device does not make a compromised wallet safe. Users whose funds were generated or managed during the affected period are still advised to create entirely new seeds and migrate their bitcoin to fresh addresses.
What we know about the theft
The incident came to light after a number of large bitcoin holdings were moved out of wallets that had been generated on Coldcard devices. Blockchain analysts identified a pattern suggesting that the affected wallets shared a common root cause in how their seeds were created. Eventually, the focus narrowed to a randomness issue in the entropy that Coldcard used to generate seeds. Coinkite has not yet released a full technical post-mortem, but the scale of the theft has been estimated at more than $114 million. That makes it one of the largest hardware wallet security events in bitcoin's history, and it has shaken confidence in a product line that was widely regarded as hardened against even sophisticated attackers.
Why randomness is so important
Hardware wallets are designed to protect private keys by keeping them inside a secure element that never exposes them to a desktop computer or mobile phone. However, a hardware wallet is only as strong as the randomness it uses to create its seed. In bitcoin, a seed is essentially a large random number that is then converted into a wallet with many private keys. If the random number generator is flawed, an attacker can mathematically reduce the possible search space and eventually generate the same seed that a victim is using. Once the attacker has the seed, they can derive every private key and sign transactions as if they owned the wallet.
Randomness failures have a long history in cryptocurrency. In 2013, a severe entropy bug in an Android bitcoin wallet app allowed attackers to steal coins from users whose keys were generated on devices with weak random number generators. More recently, several projects have suffered from similar flaws, sometimes involving compromised pseudorandom number generators or poor seed generation in web-based products. The Coldcard incident is a sharp reminder that hardware devices can also fall victim to the same class of problem.
What is in the firmware update
The new firmware, which Coinkite began distributing after a three-week review period, does more than address the randomness flaw. Coinkite says the audit, assisted by artificial intelligence tools, uncovered additional bugs that were not related to the main vulnerability. According to the company, the update includes fixes in transaction approval, USB data handling, and firmware validation. The transaction approval fix is meant to close a potential gap that could allow a malicious host to trick the device into signing one thing while showing a different address to the user. The USB handling changes tighten how the device parses incoming data, which can help prevent buffer overflow and malformed packet exploits. The firmware validation improvement is intended to make sure that only properly signed firmware can be loaded onto the device, thwarting a possible attack that requires temporary physical access.
AI catches what humans miss
Coinkite's announcement stands out not just because of the theft amount, but because the company explicitly credited AI tools with helping to find those additional bugs. The company said that frontier AI models were used to review the entire codebase, and that the approach was able to identify suspicious paths far more quickly than a traditional manual security audit would have. It is important to note that Coinkite did not say AI discovered the original randomness flaw. That appears to have been found after the theft was already underway, based on forensic analysis by researchers and affected users. Still, the use of AI in the post-incident review is a signal that even conservative bitcoin-only hardware companies are now willing to lean on large language models as part of their security workflow.
Why updating alone is not enough
Coinkite has been emphatic on one point: simply installing the new firmware does not restore safety to a compromised wallet. If a seed was created while the randomness flaw was present, the attacker may already have the seed in their possession. No software patch can change that. The only safe response is to generate an entirely new seed using a trusted source of physical randomness, such as dice rolls or coin flips, and then transfer any remaining funds to the new wallet. Coinkite has now integrated this requirement directly into the setup process. When a user generates a new seed, the device will ask for manual entropy, and the device will not continue until it receives enough randomness from the user. This is a deliberate move to reduce reliance on internal random number generators, which are a common point of failure in cryptographic systems.
Industry shift toward AI-driven security
The Coldcard incident is unfolding against a broader shift in the bitcoin ecosystem toward AI-assisted security reviews. Several open-source projects, including BTCPay Server, have begun experimenting with AI-driven code analysis. Their maintainers have reported that AI systems are capable of flagging questionable code patterns much faster than human reviewers, especially for issues like incorrect state transitions, missing validation steps, and unusual error handling. Major cryptocurrency exchanges have also created AI-focused security teams that use machine learning models to monitor transaction flows and detect abnormal wallet behavior. Perhaps most notably, the volunteer-run Bitcoin Red Team has said that AI-driven reviews are uncovering critical bugs at a significantly higher rate than manual audits. These tools are not yet perfect, and they can still produce false positives or miss context-specific issues, but they are changing the way the security community thinks about finding vulnerabilities before an attacker does.
For everyday bitcoin users, the lesson is both simple and uncomfortable. No hardware wallet is invulnerable, and firmware updates are not a substitute for operational hygiene. If a device has been exposed to a randomness vulnerability, the seed must be considered burned. Security professionals often recommend that users with significant holdings rotate their seeds periodically, store backups in multiple physical locations, and test their recovery procedures on a regular basis. The Coldcard incident adds another recommendation: use hardware wallets that give users explicit control over entropy, and never rely on a single source of randomness when creating a wallet that will hold real money.
As Coinkite continues to investigate the full scope of the vulnerability, the rest of the industry is likely to draw lessons from both the security failure and the company's response. The fact that AI-assisted review is now being credited with finding unrelated bugs is notable, but it also raises questions about how many vulnerabilities have gone undiscovered in other products. For now, affected Coldcard users have one clear path forward: rotate the seed, move the funds, and only then consider the wallet safe to use again. The broader bitcoin community will be watching closely to see whether Coinkite follows through on its promise to be more transparent about the incident and whether AI will become a standard part of every serious security audit.
Source:Coindesk News