- 594 BTC ($38 million) stolen from about 500 dormant Coldcard wallets in a 25-minute sweep
- Coinkite and Block confirmed a seed generation flaw that allowed a weak pseudo-random number generator to be used
- AI is believed to have been used to discover the vulnerability, with a developer later reproducing it using Claude Opus 5
- The flaw affected Mk3 devices and, to a lesser extent, Mk4 and Mk5 models, according to separate analyses
Someone drained nearly 600 BTC worth $38 million from roughly 500 dormant Coldcard hardware wallets yesterday, using what appears to be an AI-powered seed phrase exploit that took just 25 minutes. Reports suggest the attack will likely continue, and Bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep”>data shows the stolen bitcoin was dated between 2021 and 2026, with much of it dormant for years.
Coldcard maker Coinkite confirmed hours after the exploit that seed generation within its Mk3 wallet and updated versions beyond March 2021 may not have been random at all. Consequently, Block (formerly Square) published its own analysis, tracing the bug to a mis-written compile-time check that allowed the firmware to fall back to Yasmarang, a weak pseudo-random number generator.
Coinkite deduced that because Coldcard’s source code is open, someone likely used AI to exploit it, noting that “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.” Meanwhile, developer Stephen DeLorme claims he used AI model Claude Opus 5 to sniff out the vulnerability after cloning the firmware repository.
Bitcoin Core developer Gregory Sanders reproduced the attack using setup button-press counts, confirming its impact on Mk2 and Mk3 models. He later wrote “Sorry, this is the time to panic,” and noted that the Mk4 is “probably not much better.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- AMLBot introduces AI Tracer for crypto transaction tracking
- Google fixes 1,072 Chrome bugs, surpasses past 23 milestones
- Coinbase Posts Surprise Q2 Loss as Crypto Trading Revenue Drops
- Coldcard bug drains $40M in Bitcoin, price fears rise
- New York sues Kalshi, calling prediction markets illegal gambling
