By Thorsten Meyer
The devices that lost the money were doing exactly what they were sold to do. They kept the keys offline. They never touched the internet. They were, by design, some of the safest places on earth to park Bitcoin.
They were drained anyway — 1,816 BTC, roughly $116 million, across more than 5,200 addresses — without an attacker ever touching a single one of them.
That is the detail that makes the Coldcard incident different from the usual crypto theft, and it is the detail that has half the Bitcoin community convinced a Chinese language model pulled the trigger. One of those claims is solidly established. The other is not. Keeping them apart is the whole job here.
Offline hardware wallets were emptied without an attacker touching a single device. The keys weren’t stolen — they were regenerated, because a firmware flaw had quietly shrunk the space of possible keys to something a machine could search.
▲ AI attribution unproven · Kimi K3 claim is a community theoryA hardware wallet’s security rests entirely on one moment: the randomness used to generate its recovery seed. A 2021 firmware change quietly broke that randomness on affected Coldcard Mk3 devices.
The signature — hundreds of unrelated wallets emptied against a prepared list — points to an automated operation working from precomputed keys, per Galaxy Research on-chain analysis.
A viral post framed this as “the AI reckoning” and named Moonshot’s new open-weight model. The timing is suggestive. The evidence is not conclusive.
- K3 weights dropped 27 Jul; first draining ~29–30 Jul — two days apart
- Public firmware is exactly what an AI code agent can read
- Widely shared, emotionally resonant, and entirely uncorroborated
- UK–US AISI eval: K3’s exploit ability reaches only ~40% of frontier US models
- Independent researchers reproduced it after the flaw was public — not cold
- A 40-bit search needs no LLM; specialised hardware brute-forces it
Strip out the attribution entirely and the important finding survives.
The real shift isn’t that AI broke cryptography — the mathematics held; the software around it did not. It’s that frontier models are collapsing the window between when a vulnerability is created, discovered, and exploited. A flaw sat dormant for four years. That dormancy is becoming the exception.
and the window from dormant bug to drained wallet just got much shorter for everyone shipping code.
What actually broke
Coldcard, made by the Canadian firm Coinkite, is a hardware wallet: a small offline device that generates and stores the private keys controlling your Bitcoin, marketed to long-term holders who want cold storage they can hold in their hand.
When such a device is initialised, it generates a recovery seed — the string of random words from which every key is derived. The security of everything downstream rests on one property of that moment: the randomness has to be genuinely unpredictable. A proper seed draws on roughly 128 bits of entropy, a number so large that guessing is not a strategy any adversary can attempt.
A firmware change shipped in March 2021 quietly broke that property. According to the technical analysis published by the engineering and security teams at Block — Jack Dorsey's payments company — affected Coldcard Mk3 devices stopped drawing on strong, unpredictable randomness and fell back to a predictable, pattern-following process seeded largely by chip data. The effective entropy of those seeds collapsed from 128 bits to about 40.
Forty bits is the entire story. It is still a large number in the abstract. It is not a large number to a machine that can generate candidate seeds, derive their Bitcoin addresses, and check each one against the addresses visible on the public blockchain. The keys were never stolen off the devices. They were regenerated from scratch on someone else's computer, because the space of possible keys had quietly shrunk to something searchable.
The theft that followed was mechanical. On 30 July, Galaxy Research mapped a single 41-minute window in which 1,196 addresses were drained of just over 1,083 BTC — around $70 million. A large portion of that, roughly 594 BTC worth $38 million, went in one 25-minute sweep of about 500 single-signature wallets. Three further waves followed through the weekend and into Monday morning, bringing the running total to 1,816 BTC. The pattern — hundreds of unrelated wallets emptied in minutes against a prepared list — is the signature of an automated operation working from precomputed keys, not of victims panic-moving their own funds.
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
- Proven Security: Over 9 years of secure card issuance
- Military-Grade Encryption: EAL6+ security keeps private keys safe
- Easy Wallet Management: Tap once to access 90 blockchains
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The claim that stuck: was it Kimi K3?
Here is where the story splits, and where a publisher has to be careful.
Within hours, a widely-shared post from a pseudonymous account framed the event as "the AI reckoning," stating flatly that Moonshot's newly open-weighted Kimi K3 was "finding critical vulnerabilities in a bunch of wallets right now." The timing was the entire argument: Kimi K3's weights landed on 27 July; the first reports of draining appeared around 29–30 July. Two days between the most capable open-weight model ever publicly released and the first exploitation of a four-year-old bug is, at minimum, a suggestive coincidence.
It is also, at the time of writing, exactly that: a coincidence with a narrative attached. No investigator has linked the attack to any specific actor, human or model. Coinkite's own position is the honest one — the company says it must assume an attacker used AI to read its public firmware, while stating plainly that no evidence has established how the flaw was actually discovered. The distinction between "we must assume AI was involved" and "Kimi K3 did it" is the distinction between responsible disclosure and a viral tweet.
Two further facts cut against the confident version. First, there is a demonstrated separation between what Kimi K3 can do on general benchmarks and what it can do on security tasks specifically. A joint UK–US AI Safety Institute evaluation found the model's vulnerability-exploitation ability reaching only around 40 percent of frontier US models — a gap researchers attribute to its training having drawn heavily on distilled outputs from Western models whose security-relevant queries were filtered out. The model that tops coding leaderboards is measurably weaker at exactly the thing it is being credited with here. Second, independent researchers did reproduce the vulnerability with AI models — but after the entropy problem was already public knowledge. Using a model to explain a known flaw demonstrates how cheap AI-assisted code analysis has become. It does not establish that a model found the flaw cold, unprompted, from the firmware alone.
The intellectually honest position, which is also the useful one: this attack did not require a frontier model. A 40-bit search against public blockchain addresses is a well-understood computational problem that specialised hardware could brute-force without any language model in the loop at all. AI may have lowered the cost of finding the weakness in public code. The exploitation was arithmetic.
SEEDOR Safe Starter Kit – Bitcoin Steel Wallet, Seed Back-Up, Crypto Wallet, Recovery Phrase Offline Cold Storage, compatible with Hardware Wallets like Coldcard, Ledger, Trezor
- Secure Bitcoin Storage: Stores Bitcoin safely in stainless steel
- Compatible with Major Wallets: Works with Coldcard, Ledger, Trezor
- Durable and Fireproof: Resistant to fire, water, and corrosion
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The part that is true regardless of who did it
Strip out the attribution question entirely and something important survives, which is why the story matters beyond the people who lost money.
Coinkite ran an AI review of its own firmware weeks before the attack, and it did not catch the bug. That single fact is more instructive than any claim about Kimi K3, because it demolishes the comfortable version of the AI-security story from both ends at once. Defensive AI review is not a magic scanner that surfaces every serious defect; its performance depends on the prompt, the scope, and what it is told to look for. And whatever asymmetry AI introduces, it favours the attacker structurally — the defender must find every dangerous weakness, while the attacker needs to find one.
The genuine shift the industry is reckoning with is not that AI broke cryptography. The mathematics held; the software around it did not. The shift is that frontier models are collapsing the window between when a vulnerability is created, when it is discovered, and when it is exploited. A flaw sat dormant in public firmware for over four years. In the old world, obscurity plus the sheer cost of discovery was a form of protection — some weaknesses stayed safe in practice because finding them cost more time and expertise than most adversaries had. That protection is eroding. When an AI coding agent can inspect a public repository, follow its dependencies, compare intended behaviour against implementation, and propose a test for a suspected defect, the four-year dormancy becomes the exception rather than the rule.
The practical consequence for anyone shipping security-relevant code — and this is where it stops being a crypto story — is that periodic review is becoming untenable. The move is toward continuous testing, on the assumption that the same tools are being pointed at your public code by people who do not wish you well, at a cost that keeps falling.
ELLIPAL Crypto Seed Phrase Backup, 316 Stainless Steel Metal Seed Phrase Storage with Lock Hole, 24 Words Backup, Compatible with BIP39 Hardware Wallets, Ledger, Trezor
- Indestructible Material: 316 stainless steel, fireproof and waterproof
- Enhanced Security: Offline storage protects against hackers and malware
- Easy to Use: Supports 12 to 24-word mnemonics, BIP39 compliant
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What it means for self-custody
The incident reopened the oldest argument in Bitcoin, and reopened it in the worst possible way. The entire promise of a hardware wallet is that you need not trust an exchange, a bank, or any intermediary — you hold your own keys. This hack turned that promise inside out: the thing you were trusting instead was a firmware build process, and it failed silently for four years.
Predictably, some holders have concluded the lesson is to move to large custodial platforms — the Binances and Coinbases — and let a professional carry the burden. Even Binance's founder, ordinarily an evangelist for self-custody, framed it as a burden the individual bears. The counter-argument is equally real: centralised exchanges are the single largest honeypots in the entire ecosystem, and the history of catastrophic crypto losses is overwhelmingly a history of exchanges failing, not of hardware wallets doing so.
The correct reading is narrower than either camp's. This was not a failure of self-custody as a principle. It was a failure of one vendor's randomness in one firmware line, of a kind that a dice-roll or a passphrase would have defeated — the seeds that included user-supplied entropy were not vulnerable. The lesson is not "trust an exchange." It is that trust placed in any single implementation, however respected the name on the box, is trust in code you did not write and mostly cannot audit — and the cost of someone else auditing it against you is falling every month.
Notably, the price barely moved. Despite the crash fears that ran through the coverage, Bitcoin and Ethereum both held to under a one-percent drop across the episode. The market, at least, read this as a Coldcard problem rather than a Bitcoin problem. That judgement is probably right, and it is also probably temporary comfort: the next four-year-old bug in the next respected codebase is already sitting there, and the tools for finding it are now a free download.
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
- Proven Security: Over 9 years of secure card issuance
- Military-Grade Encryption: EAL6+ security keeps private keys safe
- Easy Wallet Management: Tap once to access 90 blockchains
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The dispatch in one line
An AI may or may not have found the Coldcard flaw. What is certain is that a defensive AI review missed it, the exploitation needed nothing more exotic than arithmetic against a shrunken keyspace, and the window between a dormant bug and a drained wallet just got much shorter for everyone shipping code. The attribution is unproven. The lesson does not depend on it.
Sources: Fortune via Yahoo Finance and Forbes (Billy Bambrough) on the loss totals and timeline; Galaxy Research on-chain analysis of the draining waves; Block engineering/security technical backgrounder on the entropy-fallback flaw; Coinkite/Coinkite CEO Rodolfo Novak public statements and advisory; crypto.news, Bitcoin.com News, PYMNTS, and Bitcoin Magazine on the 40-bit keyspace and AI-review admission; joint UK AISI/US evaluation coverage on Kimi K3's security-task performance. The identity of the attacker, and whether any AI model was used to discover the flaw, was unestablished at the time of writing; the Kimi K3 attribution is an unverified community claim. Point-in-time as of 3 August 2026. Not security or financial advice.
