The Coldcard Entropy Flaw Drained 1,816 BTC. Then an AI Red Team Found 4,962 Bugs in 27.5 Hours

What happened: four lines of code, $116 million gone

Starting July 30, 2026, users of the Coldcard hardware wallet (made by Coinkite) watched bitcoin drain from addresses whose keys never touched an internet-connected device. On-chain analysts including Galaxy Research and TRM Labs put the damage at more than 1,816 BTC (about $116 million) by mid-August, spread across thousands of addresses — the largest hardware wallet exploit of the year, executed by at least 15 independent attacker groups sweeping the chain in parallel.

The root cause was a bug introduced in a March 2021 firmware update: entropy generation that should have been performed by the hardware true random number generator was redirected to a badly-seeded software PRNG. Affected units produced seeds with an effective keyspace of roughly 40 bits. Attackers could enumerate candidate seeds offline and match them against public addresses on the ledger — no device access required. Your cold wallet could sit in a drawer while the coins left.

How weak is 40 bits, exactly?

BIP-39 seeds are designed for 128-256 bits of entropy. At 128 bits, brute force is computationally hopeless even for nation-states. At 40 bits, the space is about a trillion candidates (2^40) — a consumer GPU tests tens of millions per second, and a modest cluster walks the entire space in hours. The gap between 2^128 and 2^40 is 88 orders of magnitude: not "slightly weaker" but the difference between "impossible" and "an afternoon". That's why the exploitation looked like a land rush the moment the flaw surfaced — whoever enumerated first, won.

And it sat undetected for five years, because low entropy produces no functional symptom. Wallets generated fine, signed fine, spent fine. The only way to catch it is a reverse audit of the generation path — precisely the kind of grinding code review AI now excels at and humans avoid.

The AI red team: 390 repos in 27.5 hours

After the breach, AnchorWatch CEO Rob Hamilton and Bitcoin developer Calle assembled a 16-person "Bitcoin Red Team" with a simple premise: attackers are using AI to find bugs; defenders must use AI to find them first. The sprint's output:

• 27.5 hours, 390 open-source Bitcoin projects scanned
• 4,962 findings filed — 85 critical, 635 high-severity
• Roughly one critical finding per person-hour
• Cryptography libraries were the epicenter: 1,385 issues across 128 projects, over a quarter of the total sample

By category, mining pools showed a 21.7% finding rate, infrastructure/tooling 21.5%, swaps and exchanges 20.9%, privacy tools 24% (from only 3 reviewed projects). Curiously, hardware wallet firmware — Coldcard's own category — sat second-lowest at 9.6% critical share, yet produced the only real-world exploit. Calle's summary: "decades of open-source code colliding with a two-week-old Kimi K3," and "everything is broken, Bitcoin is on fire."

The actual story: defenders can't get the tools

The red team originally planned to run on OpenAI and Anthropic models. It didn't work out: OpenAI restricts cybersecurity-related usage, and Hamilton — after completing full identity verification — had his account banned within 20 minutes of using the model to analyze a public codebase. The team pivoted to Moonshot AI's Kimi K3 (alongside GPT Sol, Anthropic's Fable/Opus, and Zhipu's GLM 5.2, always with human verification of AI leads). Hugging Face hit the same wall investigating a real intrusion, eventually completing the log analysis with GLM after US commercial models declined.

The asymmetry is stark: attackers face zero restrictions on any tool they can rent; verified defenders get rate-limited, throttled, or banned. On August 10, the Bitcoin Policy Institute coordinated an open letter — "Defenders Need the Frontier" — signed by 40+ organizations including Coinbase, Block, BitGo, Blockstream, Trezor, Anchorage Digital, ARK Invest, Chaincode, Brink and Foundry. It doesn't ask for unrestricted access: it proposes vetted access programs with pre-release models, compute, private code-review sandboxes, and direct channels to lab security teams.

The market consequences were immediate: decentralized exchange Boltz paused bitcoin swaps because AI-driven discovery was outrunning its patching capacity. When the find-rate exceeds the fix-rate, that gap is itself a systemic risk.

Timeline of the incident

• Mar 2021: Coldcard firmware update ships the entropy redirection bug (later traced to four lines of code).
• Jul 30, 2026: Anomalous withdrawals appear; Coinkite publishes an emergency advisory; 15+ attacker groups begin sweeping.
• Early Aug 2026: The 16-person red team forms; 390 projects and 4,962 findings in the first 27.5 hours. Hamilton's verified OpenAI access is banned in 20 minutes; the team shifts to Kimi K3.
• Aug 10, 2026: "Defenders Need the Frontier" open letter published with 40+ signatories.
• Mid-Aug 2026: Galaxy Research confirms 1,816+ BTC losses; Boltz halts BTC swaps; the red team commits to open-sourcing its 171,599-line custom test framework.

Two caveats worth keeping honest: loss estimates range from 1,596 to 1,816 BTC across analytics firms (methodology and cutoff dates differ), and the 4,962 "findings" are AI leads with human triage — not 4,962 confirmed exploitable vulnerabilities. The numbers will be revised; the structural problem won't.

What this means for anyone holding digital assets

• "Open source = secure" is dead. Coldcard was fully open — "anyone can read the code" — and a five-year entropy bug survived until attackers monetized it. Open source's value now depends on whether AI can read it faster than attackers do.
• Key generation is the softest spot. The bug wasn't in transmission or signing; it was in the instant the secret was born. The same applies to your card CVVs, API keys, and wallet seed phrases: whatever is determined "at generation time" deserves independent verification, and generation should never co-locate with storage.
• Don't single-source custody. Losses concentrated among users who didn't move funds promptly. Split meaningful balances across independent key origins rather than betting on any vendor's firmware hygiene.

A three-minute self-audit

• Coldcard owners: check firmware version and when your seed was generated. Seeds created after the March 2021 firmware on affected batches must be treated as burned — move funds and re-generate with fresh entropy (Coinkite's security notice has the official guidance).
• All hardware wallet users: have you done a small-amount test recovery from your seed? A successful restore validates both your backup and your possession of the key.
• Virtual card users: are your top-up address, bound email, and 2FA channel independent? One compromise should not cascade into all three.
• Subscribe to your platforms' security disclosure channels — in this incident, users who saw the Coinkite advisory on day one kept their funds; losses concentrated among the late-informed.

FAQ

Is Coldcard still usable? New firmware is patched; seeds generated in the affected window are permanently compromised and must be regenerated.
Can the stolen BTC be recovered? Realistically no — multiple attacker groups and ongoing mixing; this is the canonical "hacked while offline" case.
Is AI auditing just false-positive spam? The pipeline is AI-leads-plus-human-triage; 85 critical findings in 27.5 hours is a density signal, not a confirmed-exploit census.
Does this affect exchanges? Swaps/exchanges showed a 20.9% finding rate and Boltz paused BTC swaps; funds on a CEX add another layer of patch-speed dependency.

Bottom line

Three lessons from the Coldcard incident. Technically: entropy generation is the root of key safety, and four lines of code ended the myth that cold storage equals absolute security. Industrially: AI has made vulnerability discovery exponentially faster while defenders are throttled by their own compliance — "Defenders Need the Frontier" is a survival statement, not a slogan. Personally: whether you manage 1,816 BTC or a handful of virtual card balances, independent key generation, distributed custody, and fast response to security advisories remain the three habits always worth your time.