Coinkite, Coldcard’s manufacturer, dropped a bombshell in its technical analysis. The company believes the attacker used AI to find the flaw.

“The firm said it had run one of the best available models over its own code a few weeks earlier, and the model ‘did not find this bug or anything serious,’” Bitget News reported.

“Attackers and defenders have the same tools,” Coinkite wrote. “But this time it did not help us, and only helped the bad guys”.

This is the part that should keep every Bitcoin holder up at night. The AI arms race in cybersecurity has officially reached hardware wallets. And right now, the bad guys are winning.

The Controversy: Who’s to Blame?

The Bitcoin community is already at each other’s throats.

A known Bitcoin developer, warned that single-signature wallets face “serious security risks” following the disclosure. “Single-sig is concentrated risk,” he essentially said, renewing scrutiny of how holders secure large balances with a single key.

Meanwhile, Block’s investigation revealed something even more disturbing. Clay Garrett, a security engineer at Block, identified 695 earlier transactions with the same fingerprint as the initial exploit—moving another 488 BTC. If confirmed, the total theft could be 1,082 BTC.

But here’s the real controversy: Coinkite hasn’t confirmed the link between the wallet issue and the on-chain movement. Some critics say the company is downplaying the severity to protect its reputation. Others argue that Mk4, Q, and Mk5 users are safe—a claim Bitcoin developer James O’Beirne has publicly questioned.

What Coldcard Owners Must Do Now

Coinkite’s advisory is brutal in its clarity: “If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk”.

Firmware updates won’t fix this. The weak seed is already compromised.

Coinkite recommends generating a new seed on patched hardware and moving funds immediately. They also suggest using a strong BIP-39 passphrase or at least 99 dice rolls to generate entropy.

Summary

The Coldcard hack isn’t just a theft—it’s an existential crisis for Bitcoin self-custody.

On one hand, the bull case remains intact. Multi-sig wallets and BIP-39 passphrases appear to have mitigated the risk. The core Bitcoin ecosystem is resilient, and this attack targeted a specific vulnerability in a single manufacturer’s firmware.

On the other hand, the bear case is terrifying. If a hardware wallet as trusted as Coldcard can be compromised by a bug that went undetected for five years—and if AI can find vulnerabilities that human developers and even AI security scans miss—what does that say about every other wallet on the market?

This isn’t about FUD. It’s about reality. The attack happened. The money is gone. And the only thing protecting your Bitcoin is code you can’t read, written by people you’ve never met, running on hardware you assume is secure.

Trust, but verify. And right now, verification means moving your funds—immediately.