Coldcard’s RNG flaw is still draining wallets, and an AI audit just found 85 more critical bugs across Bitcoin

A five-year firmware error turned Coldcard into the largest known Bitcoin seed-theft, while AI-assisted analysis of the broader ecosystem is surfacing how systematically the industry has underestimated the same class of vulnerability. Summary Attackers have stolen a confirmed 1,596 BTC from about 7,300 Coldcard addresses across three attack waves, with total losses potentially reaching 2,055 BTC, close to $130 million, if a fourth wave is verified through victim reports. The breach originated in a March 2021 firmware error that silently substituted a predictable software pseudo-random number generator for Coldcard’s hardware true random number generator during wallet seed creation, leaving seeds with as few as 40 bits of effective entropy on older devices. Fifteen or more distinct attackers have exploited the same flaw without physical device access, and roughly 90% of stolen funds remain unmoved, giving investigators a narrow window to coordinate with exchanges and law enforcement before laundering activity accelerates. Block’s Bitcoin engineering and security team independently confirmed the flaw, and Coinkite has released corrected firmware and destroyed all affected-device inve...