Hacked Canadian bitcoin company warns others relying ‘on open-source code’ that AI security failed
- Coinkite Inc., the company behind the Coldcard Bitcoin wallets, revealed that artificial intelligence failed to detect a critical software flaw exploited by hackers to steal approximately $130 million in users’ funds.
- The vulnerability existed at the intersection of two software components in the firmware, an area often overlooked in standard security reviews, highlighting risks for all companies using AI for security-critical code analysis.
- The hack has shaken investor confidence in hardware wallets and the broader principle of self-custody in crypto, potentially causing long-term repercussions for the digital asset ecosystem.
- Following the breach, there was a significant rush to move Bitcoin into safer storage, while Coinkite urges the crypto industry to review the limits of AI tools in detecting complex vulnerabilities and stresses the need for targeted security testing.
The company at the center of a Bitcoin hack has warned that artificial intelligence failed to detect the software flaw that was exploited to steal users’ funds, now estimated at US$130 million.
Canada-based Coinkite Inc., whose affected Coldcard wallets were drained late last week, said the vulnerability the hackers discovered “is a warning for every company building Bitcoin hardware and software, not only us.” Firms using AI to monitor security-critical code should undertake immediate reviews, Coinkite said in a blog post on its website.
“If your team relies on AI review of security-critical code, we recommend you test it specifically against build and sub-module boundaries,” Coinkite said. “We believe many Bitcoin projects, including those that rely on open-source code, require immediate review.”
The Coldcard hack has unnerved crypto investors because so-called “hard” wallets, which use physical hardware to store private keys and are not connected to the internet, are considered one of the safest ways to secure digital tokens. The breach has put scrutiny on self-custody, one of crypto’s founding principles.
“Self-custody is a hallmark of digital assets, but Coldcard shows how one point of failure can shake trust in the whole model,” said Nikhil Raghuveera, chief executive officer of Predicate, a blockchain compliance infrastructure provider. “The repercussions could be long-lasting because the ecosystem is built on the promise of being trustless. Over time, the bigger risk is that investors move away from digital assets entirely.”
Following the hack, roughly 728,000 Bitcoin wallets moved funds in a single day, according to Ki Young Ju, founder of CryptoQuant. The rush to move the tokens was significant enough to push down the “mean coin age,” a measure of the average number of days tokens have remained dormant, for the first time this year, he wrote in a post on X.
“The excess likely reflects a move to safer storage,” he wrote.
Galaxy Research estimates that four suspected attack waves in the Coldcard hack have resulted in losses of about $130 million, according to its latest analysis.
Coinkite said the bug appears to have lived in the part of the firmware where two separate software components interact, not in the parent code or cryptographic logic that are subject to most reviews.
It’s important for the broader ecosystem to understand how the bug arose and why it evaded detection, “so they can avoid similar consequences,” it said.
“We’ve run AI-assisted review against our critical codebases, including in the weeks before the exploit,” Coinkite said. “It did not catch this vulnerability.”
Since the incident, Coinkite has tested its code against several frontier AI models, and “none of them caught it,” the company said.
“It’s a reason for us, and anyone else relying on AI tools, to be specific about what they currently catch and what they might not.”