AI Exploit Drains $38M in Bitcoin From Coldcard Wallets
Coinkite suspects hackers used artificial intelligence to comb through old open-source firmware and uncover a critical vulnerability.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- A hardware wallet flaw resulted in $38 million worth of Bitcoin being stolen.
- Coinkite revealed that the attacker likely used AI to inspect past versions of its open-source firmware.
- The breach highlights a growing security risk as AI tools make automated vulnerability scanning cheap and fast.
Hackers just walked off with $38 million in Bitcoin from Coldcard hardware wallets. The kicker? The wallet's maker thinks artificial intelligence handed them the key.
Scanning Legacy Code
Coinkite, the company behind Coldcard, says an attacker almost certainly used AI tools to digest old versions of its open-source firmware. Feed enough legacy releases into a model, and it'll spot the hidden crack you missed years ago.
That's the messy paradox of open source. Public code keeps devs honest because anyone can audit it. But "anyone" includes the bad guys, who get a free, detailed map of every change you've ever committed to the repository.
Why it matters
Cold storage rests on one assumption: your wallet's firmware won't betray you. This hack flips that balance. Finding obscure bugs used to take human researchers weeks of tedious reverse-engineering. Now? Automated systems crunch thousands of lines of code in seconds flat. Open-source transparency is still essential, sure. But right now, it's also giving rogue AI agents a front-row seat to hunt down your unpatched mistakes.
Source: Decrypt
Top Crypto Casinos Right Now
🇪🇸 Showing sites that accept players from Spain Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
SIGN UP BONUS 150%
- Taking bets since 1996, same owners the whole way
- Sportsbook, casino and poker on one balance
- Bitcoin out in 1–24 hours
Why we chose it: Thirty years of paying people, no ownership shuffles, no mass-confiscation scandal. You trade crypto choice and a modern interface for that.
More info Less info
- Online since
- 2011
- Licence
- Curaçao
- Min deposit
- $25
- Payout time
- 1–24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Austria, Germany, United Kingdom, France, Slovakia.
100% Welcome Bonus up to 5BTC
- Taking US action since 1994
- 200% crypto welcome bonus
- Sportsbook, racebook and casino on one balance
Why we chose it: Built for American bettors, priced accordingly. Biggest welcome bonus of the five, attached to the heaviest rollover of the five.
More info Less info
- Online since
- 1994
- Licence
- Curaçao
- Payout time
- 24–48 hours (crypto)
- Wagering
- 18x sportsbook / 30x casino
- KYC
- Required
Restricted countries: Belgium, Costa Rica, Croatia, Curaçao, Aruba, Sint Maarten, Caribbean Netherlands, France and 11 more.
20% Cashback up to 10,000 USDT
- 17 coins, the widest cashier of the US-facing books
- $10 crypto minimum against $50 for cards
- Welcome free bet carries no rollover
Why we chose it: Widest coin support of anything that still takes Americans, with poker and esports on the same balance. The complaint record is why it is not higher.
More info Less info
- Online since
- 2004
- Licence
- Panama
- Min deposit
- $10
- Payout time
- Within 24 hours (crypto)
- Wagering
- None on the free bet, 10x on the crypto boost
- KYC
- Required
Restricted countries: Australia, United Kingdom, France, Netherlands, Malta, Slovenia, Panama, North Korea and 19 more.
Priya Nair
Priya covers the AI side of crypto — agent tokens, decentralised compute and where the two industries actually meet.
