$38M in Bitcoin Stolen From Coinkite Coldcard Wallets Amid Security Flaw

A security flaw in Coinkite's Coldcard hardware wallets has allowed an attacker to drain tens of millions of dollars' worth of Bitcoin from roughly 500 wallets. The losses are estimated at $38 million, with 594 BTC stolen and consolidated into a single address.

Coinkite believes the flaw was discovered using AI on its open-source code, despite its own AI review weeks earlier finding nothing.

The issue stems from a build error that caused seeds to be generated from a software fallback instead of the hardware generator, making them far more guessable than intended.

Coinkite has shipped an emergency hotfix for affected models, but owners need to generate new seeds on patched hardware to secure their funds.