Coldcard Updates Firmware After $114M Hack, Says AI Uncovered More Vulnerabilities

• A three-week security review found several issues beyond the vulnerability that resulted in the $114 million bitcoin theft. Coinkite said, however, that installing the latest firmware does not make a wallet safe if it was already compromised.
• Coinkite, the Canadian developer of the Coldcard hardware wallet, has released new firmware weeks after revealing the flaw that allowed attackers to steal more than $114 million worth of bitcoin.
• The company said artificial intelligence assisted the review, with Kimi and other advanced AI models used to investigate the original randomness problem and audit the wider Coldcard system.
• The assessment uncovered additional vulnerabilities involving transaction approvals, USB data processing and firmware-update verification.
• A firmware upgrade cannot repair an already compromised wallet. Users who generated a seed or master key with affected firmware between 2021 and July 2026 must create a new seed and transfer their funds to a new wallet.
• Coldcard has redesigned its seed-generation process to require user-supplied physical randomness. Users can choose between 65 unpredictable key presses, 50 six-sided die rolls or 128 coin flips.
• Coinkite said physical inputs provide randomness that software cannot predict, addressing the type of automated randomness failure involved in the original vulnerability.
• The company also replaced its backup random-number generator, switching from Yasmarang to a SHA-256-based system. SHA-256 is the same hashing algorithm used by Bitcoin.
• The updated device now performs a final transaction check immediately before signing. This is designed to stop a compromised computer connected over USB from changing a payment after the user has approved it on the Coldcard screen. Signature modes that allow parts of a transaction to be modified after signing are now blocked by default.
• Coinkite said law enforcement agencies continue to investigate the thefts and are working to identify those responsible. The company said it remains available to assist investigators.
• Owners of Coldcard Mk4 and Mk5 devices should install version 5.6.1, while Q model owners should use version 1.5.1Q. Coinkite recommends downloading the firmware only from its official website and has published a status page outlining the fixed releases and required migration procedures.

AI Expands Its Role in Crypto Security

• Coldcard is among a growing group of crypto companies highlighting AI’s role in vulnerability research, becoming the fifth bitcoin or crypto firm in three weeks to publicly discuss the technology’s impact on security work.
• BTCPay Server, an open-source payment platform for bitcoin merchants, was attacked this month after a vulnerability allowed attackers to drain users’ Lightning nodes. The project is offering a bounty of up to 3 BTC for recovered funds and has paid 0.42 BTC to researchers who discovered the flaw. It has also urged merchants to keep funds in cold storage and regularly move excess assets out of hot wallets.
• Dozens of Bitcoin companies, including Coinbase, Block, BitGo and Blockstream, signed an Aug. 10 open letter asking AI labs to give open-source security researchers early access to their most advanced models.
• The volunteer Bitcoin Red Team has become one of the most visible initiatives in this area. Its 16 developers identified 4,962 findings across 390 projects during their first 24 hours, including 85 critical and 635 high-severity issues. Their work also contributed to the research that led to BTCPay Server’s patch.
• Bybit, which suffered an estimated $1.46 billion theft attributed to North Korea’s Lazarus Group in February 2025, said AI-powered audits found high-severity vulnerabilities at three to five times the rate of manual reviews. The exchange also reported that AI helped block around $700 million in suspicious withdrawals during the first half of the year.