By Thorsten Meyer
In about forty-one minutes on 30 July, someone drained 1,082 Bitcoin — roughly seventy million dollars — from 1,196 wallets. Not through phishing. Not through a stolen password. Through a bug that had been sitting, untouched and undiscovered, in the firmware of one of the most respected hardware wallets on the market for over five years.
The victims were not careless. They were the opposite. They had bought a Bitcoin-only hardware wallet from a company known for its obsession with security, kept their keys offline, followed every rule. One of them lost 1.6 million dollars and, by every account, had done nothing wrong. Since that first sweep the theft has grown past a hundred million dollars across more than five thousand addresses, with a dozen or more copycat attackers now piling into the same open door.
I want to walk through exactly what happened, because the mechanism matters. Then I want to explain why this is not a crypto story — why it is the clearest early photograph we have of a new security era that is coming for everything. And then, because fear without action is useless, I want to give you a practical way to start hardening your own digital life this week.
A warning I will repeat up front, because it is the honest spine of this piece: parts of what follows are established fact, carefully sourced. Other parts — the ones about who did this and how they found it — are my reading, and I will mark them clearly as mine. The line between the two is exactly the discipline this moment demands.
What actually happened
Every hardware wallet rests on one idea: a private key so enormous and so random that no one could ever guess it. The private key is the secret that moves your money; the public address is the account number anyone can see. They are mathematically linked, but the link only runs one way — from the private key you can derive the address, never the reverse. The security of the entire system depends on the private key being drawn from a pool so vast that brute force is meaningless. Guess randomly and the sun burns out before you land on a real one.
That is the promise. Here is what broke it. In a firmware update shipped in March 2021, an integration error quietly rerouted the wallet’s key generation away from the device’s dedicated hardware random-number generator and into a deterministic software fallback. Instead of drawing seeds from a near-infinite pool, affected devices drew them from a dramatically smaller one — by the manufacturer’s own later account, on the order of forty bits of entropy on the older models, seventy-two on the newer ones, against the 128-plus bits the design intended. The keys were still random-looking. They were just drawn from a shrunken universe.
A shrunken universe is a searchable one. Once an attacker understood the flaw, they could sit at an ordinary computer — offline, even — and generate every private key the broken process could possibly have produced. From each key they derived the public address. Then they went online, checked those addresses against the public blockchain to see which ones held a balance, and — this is the part that turns a bug into a heist — sorted the hits by size. Largest first. A script did the rest, sweeping wallet after wallet in a rush that took under an hour to clear seventy million dollars. There is no fraud department to call. There is no chargeback. That irreversibility is the entire point of Bitcoin, and on 30 July it cut the wrong way.
The company behind the wallet, Coinkite, has been candid that the root cause was its own engineering error. Its CEO, Rodolfo Novak, wrote to the developer community with a line that has stayed with me: this is the sober reality of a new AI paradigm, in which AI-assisted code review can now surface latent bugs faster than the industry’s most seasoned experts. And the detail that makes his point land: Coinkite had itself run an AI-assisted audit of its firmware only weeks earlier — and missed this.
A firmware error shrank the pool that “random” keys were drawn from. A searchable pool is a drainable one. Here is the mechanism, conceptually — no operational detail.
A March 2021 firmware update rerouted key generation from the device’s hardware random-number generator to a deterministic software fallback — drawing seeds from a dramatically smaller universe.
Once the flaw is understood, the whole attack runs on an ordinary machine — no internet needed until the final move.
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
- Proven Security: Over 9 years of secure card issuance
- Military-Grade Encryption: EAL6+ security keeps private keys safe
- Easy Wallet Management: Tap once to access 90 blockchains
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The part that is my hypothesis, not fact
Now the honest boundary. Was AI used to find or execute this specific attack? There is no public proof that it was. No researcher has yet published a reconstruction that takes the flawed process, regenerates a victim's seed, and matches it to a drained address; the security analysts who have looked attribute the root cause to human engineering error, full stop. So I will not tell you AI did this. I will tell you what I actually believe, labelled as belief: if I were betting, I would bet an AI model was involved somewhere in the chain — the discovery, the tooling, the speed. Call it a one-in-a-thousand chance it was pure human coincidence. But that is my read of the timing and the shape of it, not a documented fact, and you should hold it exactly that loosely.
The timing is what fuels the suspicion. This bug sat dormant for more than five years, through a period when, quite literally, billions of people shared the planet with it and no one found it. Then, within about two weeks of a particular frontier model reaching the open-source world, someone found it, did the preparation, and executed. I have a view on which model and why, and I want to be scrupulous that this next part is speculation stacked on speculation: my own reading is that Kimi K3 may be, in part, a distillation of Anthropic's Fable — the guardrailed sibling of the Mythos model that was considered too capable to release openly — meaning its outputs were used to train something with a similar capability profile but without the same safety constraints. I cannot prove that. Anthropic has not confirmed it and may well dispute it. Treat it as a hypothesis I hold, not a claim I have established. What is not speculation is the pattern it points at, and the pattern is the actual story.
Bitkey Bitcoin Hardware Wallet - Secure Wallet for Self Custody, No Seed Phrase, 2-of-3 Multisig Security, NFC Device, iOS and Android Compatible
- Self Custody Bitcoin Wallet: Secure your bitcoin independently
- No Seed Phrase Needed: Reduces risk of loss or theft
- 2-of-3 Multisig Security: Multiple approvals for transactions
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Why this is coming for everything
Strip away the crypto specifics and here is the shift, stated plainly. For decades we treated open-source and formerly-public code as more trustworthy, because many eyes could inspect it and flag its flaws. That logic quietly inverted. The same public availability that let friendly reviewers find bugs now lets AI systems crawl the world's repositories at machine speed, and the thing they are very good at — better, right now, than they are at almost anything defensive — is finding the crack that human reviewers missed.
Novak's phrase for it is the one I keep coming back to: a time machine. If your firmware, your software, or any third-party library buried somewhere in the stack it depends on has ever been public, assume it is being read right now — by defenders hardening it, and by attackers hunting it. The vulnerability does not have to be new. It can be twenty years old. What is new is that discovering it no longer requires a human expert with years to spare; it requires compute and a few hours. You do not interact with raw code in daily life, but everything you touch — your bank, your email, your phone — rests on a tower of it, and any one weak brick makes the whole structure porous. We used to picture our digital walls as steel. The better picture now is a building riddled with holes we are only beginning to find, with a swarm of automated probes running a hand over every surface, looking for the way in. Some of that swarm is friendly. Some of it is not.
This is not hypothetical at the infrastructure level either. Triggered directly by the ColdCard drain, a Bitcoin security "red team" ran AI-assisted audits across 390 open-source Bitcoin repositories and surfaced nearly five thousand findings — 4,962, to be exact — including 85 critical and 635 high-severity issues, in roughly twenty-seven hours of machine time. Bugs that had plausibly existed for years, invisible to the collective human eye, enumerated in a day. That is the good news and the warning in a single number: the same capability that found them for defenders is available to everyone else, and Bitcoin's repositories are not uniquely sloppy. If anything, security-critical code attracts more careful people than average. Assume the rest of the software world is at least as exposed.
For decades, "many eyes" made open and public code more trustworthy. AI crawling at machine speed quietly inverted that logic — the same visibility that helped defenders now serves attackers.
Even a bank with world-class security rests on a tower of code — third-party vendors, libraries, foundations. One weak brick makes the whole structure porous.
hardware wallet with secure random number generator
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The closed-door demo, and the haves and have-nots
Here is where it stops being about crypto and starts being about who holds the shield.
Some months ago, Anthropic reportedly gave a closed-door demonstration to lawmakers and regulators — an account associated with Representative Andrew Garbarino — in which one of its models was pointed at a simulated bank's systems, found a vulnerability that could drain funds, and then also patched it. Find the hole; fix the hole. The same capability, pointed in either direction. And we know the Federal Reserve and senior figures across the financial industry have convened repeatedly over the capabilities of the Mythos-class models, because the thing those models demonstrate is that the "steel walls" of our financial infrastructure were always more porous than we believed — and that the models can now find the holes.
The problem is distribution. The most capable defensive AI is not evenly available. The largest US institutions have access through Anthropic's Project Glasswing tier; the frontier labs have their own equivalents. But smaller banks, most crypto platforms, wallets, exchanges, and a great many financial firms do not sit inside that circle — and neither, structurally, does much of Europe. This is the uncomfortable through-line to everything else I write about sovereignty: the defensive capability is a frontier good, and access to the frontier is unevenly held. If attackers can find a vulnerability and simply wait — generate everything, sit on it, execute across thousands of targets at the moment of their choosing, exactly as happened here — then being outside the circle of the best defensive models is not a minor disadvantage. It is the difference between patching the hole before the sweep and reading about the sweep afterward.
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
- Proven Security: Over 9 years of secure card issuance
- Military-Grade Encryption: EAL6+ security keeps private keys safe
- Easy Wallet Management: Tap once to access 90 blockchains
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
And it is accelerating: the cryptography front
If that were the whole story it would be enough. It is not, because a second curve is bending at the same time, and it runs straight at the mathematics underneath everything.
Frontier models are getting genuinely good at attacking cryptography. They are not inventing alien mathematics; they are remixing what we know, combining ideas across fields at a speed and breadth no human team matches — and the results are real. Anthropic published research in which its Mythos-class model was set loose on HAWK, a candidate in NIST's post-quantum digital-signature process. HAWK had survived roughly two years and multiple rounds of expert human review with no one finding a fatal flaw. The model, running for about sixty hours at an API cost on the order of a hundred thousand dollars, operated by someone with no specialist background in the underlying lattice mathematics, found a genuinely new line of attack that cut the scheme's key-recovery strength roughly in half — from the equivalent of 2⁶⁴ down to 2³⁸. The HAWK team withdrew it from the process within about a day. The same model reportedly invented a new technique against AES, which its operators named the "Möbius Bridge," hundreds of times faster than prior approaches on a reduced-round version.
Neither of these breaks the encryption protecting your bank account today. That is the correct caveat and I will state it firmly. But notice the shape. Two years of the best human review find nothing; sixty hours of a frontier model find a halving. And notice what is conspicuously absent from the headlines: no AI has announced a new, stronger, unbreakable encryption method. Right now the technology is markedly better at breaking protection than at building it — a dangerous asymmetry when the same tools are available to both sides and the attackers only need to win once.
Layer the quantum timeline on top and the asymmetry gets sharper. Scott Aaronson — for two decades the field's most reliable skeptic, the man whose entire reputation was built on pouring cold water on quantum hype — published a post at the end of April titled, pointedly, "Will you heed my warnings NOW?" His message: the most reputable people he knows in quantum hardware and error correction, people whose judgment he trusts above his own, now tell him a fault-tolerant quantum computer able to break deployed cryptosystems ought to be possible by around 2029. The official migration timelines — Coinbase and many institutions are targeting a full move to post-quantum encryption by 2035 — assume more runway than the experts closest to the hardware now think we have. And AI is precisely the accelerant: error correction, long the bottleneck, is being pushed forward by transformer-based systems like Google DeepMind's AlphaQubit.
This is where the ColdCard drain stops being a crypto anecdote and becomes a scale model. Governments already harvest encrypted data they cannot yet read — Russia, China, the US, anyone with the storage and the patience — on the bet that a future capability makes today's secrets readable. Store now, decrypt later. It is the same move as the wallet attacker who generates everything offline and waits for the moment to sweep: the discovery and the exploitation come apart in time. Seventy million dollars in forty-one minutes is a small, fast rehearsal for what a broken cryptographic primitive would mean at the scale of the entire financial system.
Frontier models are getting genuinely good at attacking cryptography, faster for offense than defense. Layer the quantum timeline on top, and the asymmetry sharpens.
A Mythos-class model was set loose on HAWK, a NIST post-quantum signature candidate that had survived ~2 years and multiple rounds of expert review with no fatal flaw found.
Scott Aaronson — for two decades the field's most reliable quantum skeptic — now relays that a fault-tolerant machine able to break deployed cryptosystems "ought to be possible by around 2029."
The most capable defensive AI is a frontier good — and access to the frontier is not evenly distributed. This is the sovereignty through-line.
- Largest US institutions via Project Glasswing & equivalents
- Can point a Mythos-class model at their own infrastructure this quarter
- Find the hole and patch it before the sweep
- Wallets, exchanges, smaller & regional banks — no frontier access
- EU AI Act constrains how fast regulated firms can deploy defensive AI
- Read about the sweep afterward
The honest counter-argument
Let me put the strongest version of the other side, because it is real and parts of it are right.
This was, at bottom, an engineering mistake. Coinkite shipped a bad build; a hardware RNG got bypassed by a software fallback; that is a human error with a human fix, and it would have been a catastrophic flaw whether or not a single AI was ever pointed at it. You do not need the AI framing to explain the drain. Furthermore — the fair objection to my own emphasis — I am the person who works on AI infrastructure all day, so of course I see an AI story here; someone else might reasonably read the same facts as an ordinary supply-chain-of-code failure of the kind that predates modern AI entirely. And the reassuring half of the ledger is genuine: the same models that find these holes are, in the same motion, being used to patch them, and the Bitcoin red-team sweep is defenders winning, not losing.
All of that has force. Here is why I hold my position anyway. The point was never that AI created a new kind of vulnerability; it is that AI collapses the time between a latent flaw existing and someone weaponizing it — and it does so asymmetrically, faster for offense than defense, and unevenly, better-resourced for the few than the many. You can grant that every individual bug is an old-fashioned human mistake and still be left with a world where old-fashioned human mistakes that used to lie harmlessly undiscovered for years now get found and drained in an afternoon. The mistake is old. The consequence is new. That is the whole argument, and the counter-case, fairly stated, does not dissolve it.
Where I land on Europe — and I know how this sounds
One conclusion here cuts against my own instincts, and I am going to state it plainly because dodging it would be dishonest.
For the time being, while this shakes out, I think a lot of us are safer keeping our money and our digital lives closer to the large, well-resourced, AI-adjacent ecosystems than to smaller, more peripheral ones — and that includes being warier of smaller European banks specifically. I hate writing that. Everything I believe points toward decentralization, toward smaller institutions, toward not concentrating power in a handful of giants. But the security reality of this exact moment is that the institutions inside the frontier-AI circle can find and patch their holes at machine speed, and the ones outside it cannot.
And here is the part that is my opinion, stated as opinion: Europe has, with the AI Act, built the world's most comprehensive framework for regulating AI — and in doing so has constrained how quickly its own regulated banks and firms can deploy frontier AI defensively. The same rules that govern the technology responsibly also slow the defender who most needs to move at the attacker's speed. A large US bank inside Project Glasswing can point a Mythos-class model at its own infrastructure this quarter. A smaller European bank, operating under a stricter regime for what AI it may use and how, is more likely to be structurally prevented from mounting the same defense at the same pace. I would, right now, feel safer with my money behind a defender that has frontier AI than one that is regulated out of using it well — and I say that as someone who wants European sovereignty to succeed, not as someone cheering the concentration. The regulation is not wrong to exist. But in this specific window, on this specific threat, it has a cost, and the cost is defensive speed. Naming that honestly is not anti-European. Pretending it away would be.
Harden now: what to actually do
The era of set-it-and-forget-it security is over, but the response is not fear — it is a handful of habits that meaningfully raise your baseline. Here is where I would start, and what I am doing myself.
Treat updates as urgent, not annoying. When a device or app offers a new version, install it immediately; those patches increasingly close holes that automated tools have only just found, and the speed of discovery is rising. Move your two-factor authentication off SMS and onto an authenticator app, and onto a hardware key where you can — and lock down your email account above all others, because it is the first domino that topples the rest. Use a password manager with a unique password everywhere, and virtual card numbers for online spending where your bank supports them. Reboot your phone daily; some classes of malicious process live only in memory and die on restart, and most of us almost never restart. Audit what is quietly connected to your accounts — the apps you linked to your bank or email years ago and forgot — and revoke what you no longer use. Turn off Bluetooth, AirDrop, and remote-desktop features when you are not actively using them; each is a door, and there is no reason to leave doors open on the most relaxed setting. Be suspicious of browser extensions; no one has hand-audited every one in the store. And compartmentalize: if you experiment with unproven AI agents or software, do it on a separate, disposable machine — a mini PC — not on the device that holds your financial and personal life. Treat always-on devices with more caution than ones you shut down at night, precisely because they can be busy while you are not watching.
None of this is exotic, and none of it makes you invulnerable. It makes you a harder target than the person next to you, which, when the probing is automated and indiscriminate, is most of the game.
Set-it-and-forget-it security is over. None of this makes you invulnerable — it makes you a harder target than the person next to you, which, when the probing is automated, is most of the game.
I'm not betting that way — so harden what you control this week.
Where this leaves us
A five-year-old bug, drained in forty-one minutes, by an attacker who could generate every possible key offline and simply wait for the right moment — that is the whole new era in miniature. The discovery and the exploitation have come apart in time. The tools that find the flaws are, for now, better at offense than defense and unevenly held. And a second clock, the cryptographic one, is ticking toward 2029 on the experts' estimate while the official plans assume 2035.
I would genuinely love to be wrong about where this goes. If, twelve or eighteen months from now, there has been no wave of drained accounts and ransomed data and quietly emptied wallets, I will be delighted to have been too gloomy, and I will say so. But I am not betting that way. I am betting on more of this, not less — and the reasonable response to that bet is not panic. It is to assume the walls are more porous than they look, to harden what you can control this week, and to think clearly about who is standing inside the circle of the best defenses and who has been left outside it. The time machine is open. It reads the past at machine speed. The only question left is who gets to the vulnerabilities first.
Reality Check and analysis from a builder, founder, and post-labor economist running a local-first inference operation. Verified facts are drawn from contemporaneous reporting and primary sources (Galaxy Research and crypto-security coverage of the ColdCard/Coinkite drain; Coinkite's own disclosures and Rodolfo Novak's statements; Anthropic's published research on the HAWK post-quantum candidate and the Mythos-class models; the AI-assisted Bitcoin repository "red team" audit; and Scott Aaronson's April 2026 "Will you heed my warnings NOW?" post, alongside official post-quantum migration timelines). Figures are point-in-time and were accurate as reported at the time of writing (early August 2026); the total stolen has continued to move. Clearly marked as the author's own hypotheses, not established fact: that AI was involved in discovering or executing the ColdCard attack, and that Kimi K3 is in part a distillation of Anthropic's Fable model. The assessment of the EU AI Act's effect on defensive deployment is the author's opinion. This is security analysis, not financial, investment, or security-engineering advice. Point-in-time as of 6 August 2026.
