Coinkite fixes Coldcard firmware after AI-led exploit drains $70M in Bitcoin

Vulnerability in Canadian-made hardware shakes self-custody norms

The intersection of artificial intelligence and blockchain security has reached a critical inflection point in the Canadian ecosystem. Coinkite, the Toronto-based manufacturer of Coldcard hardware wallets, has issued urgent firmware updates following a major security breach that resulted in the theft of approximately $70 million in Bitcoin [1]. The incident highlights a shifting threat landscape where autonomous agents and AI-driven analysis are increasingly used to identify latent software bugs that human auditors have missed for years [2].

Security researchers at Galaxy Research reported that nearly 1,200 addresses were drained of more than 1,000 BTC in a highly coordinated 25-minute sweep [1][3]. Unlike typical phishing attacks or physical device compromises, this exploit targeted a vulnerability in the randomness generation of older Coldcard firmware, specifically the Mk3 models [4]. By uncovering weaknesses in how private keys were generated, attackers were able to recreate seed phrases offline and move funds without ever touching the physical hardware [5].

The Role of AI in the Breach

This exploit is being framed by industry experts as a landmark case for the “AI paradigm” in cybersecurity. Coinkite founder NVK stated that the speed at which the vulnerability was identified and exploited suggests the use of AI-assisted code review [2]. The manufacturer believes that attackers likely used large language models or specialized AI agents to scan previous versions of its open-source firmware to find “impossible to guess” seeds that were, in fact, guessable through computational brute force [6].

For Canadian blockchain infrastructure providers, this represents a new class of risk. While open-source code is traditionally viewed as more secure due to public scrutiny, the ability of AI to perform deep, multi-version audits at machine speed removes the time buffer that human developers previously relied upon to patch legacy code [2]. As autonomous agents move from theoretical threats to active participants in the on-chain economy, the margin for error in cryptographic primitives has effectively vanished.

Institutional and Retail Fallout

The scale of the loss—calculated at roughly $70 million across more than 1,000 wallets—has prompted a reassessment of self-custody risks for both retail and institutional investors [7]. While the Coldcard is widely considered one of the most secure “air-gapped” solutions in the market, the fact that funds were swept without physical access undermines a core tenet of hardware security. Observers expect this event to accelerate the migration of assets toward institutional-grade ETFs or multi-signature custody arrangements where the risk is not concentrated in a single manufacturer’s randomness library [7].

In response to the crisis, Coinkite has released fixed firmware and urged all Mk3 users to migrate their funds to new wallets created with a strong, unique BIP-39 passphrase [4]. The manufacturer noted that adding a user-generated passphrase provides an extra layer of entropy that protects against the underlying randomness bug [8]. However, for the users whose funds were swept in the initial 25-minute window, the immutability of the Bitcoin network means those losses are likely permanent [3].

Implications for the Canadian Ecosystem

As a prominent leader in the global hardware wallet market, Toronto’s Coinkite faces significant reputational pressure to address how AI-driven threats change its development lifecycle. The Alberta Securities Commission and other Canadian regulators have already increased scrutiny on crypto-asset service providers following the barrings of exchanges like Calgary’s Catalyx [9]. While hardware manufacturers operate under different regulatory frameworks than exchanges, the catastrophic loss of $70 million in Canadian-engineered products will likely invite fresh inquiries into consumer protection standards for digital asset storage tools.

Furthermore, the event serves as a warning for the broader move toward agentic finance. If AI can be used to break the trust layer of hardware wallets, the security of AI agents performing autonomous payments becomes even more precarious [10]. The industry must now determine if the very tools being built to automate the economy—AI-enabled auditors and autonomous transactors—are outpacing the defensive infrastructure meant to contain them.

Sources

1. https://www.theblock.co/post/410332/bitcoin-losses-linked-coldcard-vulnerability-70-million-galaxy-research
2. https://bitcoinmagazine.com/business/coinkite-releases-fixed-firmware-after-coldcard-bug-ai-likely-involved-in-the-hack
3. https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep
4. https://www.theblock.co/post/410235/coinkite-coldcard-mk3-warning
5. https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices
6. https://decrypt.co/374766/38m-in-bitcoin-drained-by-coldcard-key-flaw-its-maker-thinks-ai-found
7. https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs
8. https://cointelegraph.com/news/coldcard-mk3-warning-594-btc-sweep
9. https://betakit.com/calgary-crypto-exchange-catalyx-permanently-barred-from-operating/
10. https://decrypt.co/374741/xdc-ai-and-the-rise-of-agentic-finance-when-ai-agents-learn-to-pay