AI-assisted code review fails to detect Coldcard wallet vulnerability enabling $100M Bitcoin theft
Coinkite acknowledged that multiple AI-assisted code review tools, including advanced models, failed to detect a vulnerability in its Coldcard Bitcoin wallet software. The flaw in how two submodules interacted allowed attackers to reconstruct private keys and steal at least $100 million in Bitcoin across three confirmed attack waves.
What happened
Coinkite, a Canadian company based in Toronto, acknowledged that AI-assisted code reviews failed to detect a vulnerability in its Coldcard wallet software that enabled attackers to steal at least 1,596 bitcoins valued at over $100 million.
The vulnerability lay in the interaction between two unrelated submodules rather than in the main code or cryptographic logic. Coinkite had analyzed critical systems with AI tools weeks before the attacks and retested the code with several advanced models after the incident, but none identified the flaw.
Reported impact
Attackers reconstructed private keys and stole at least 1,596 bitcoins from approximately 7,300 addresses across three confirmed waves of attacks, with Galaxy Research identifying additional unconfirmed incidents.
Index analysis
The vulnerability represents a challenge for automated code reviews because individual components functioned correctly in isolation, but the interaction between the two submodules created a security breach.
Coinkite recommended that manufacturers of similar devices pay special attention to connections between modules during security audits.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.