Developers used Claude Code to scan the Coldcard open-source firmware and identified within 8 minutes that the firmware invoked a software pseudo-random number generator instead of a hardware true random number generator when generating private keys—a vulnerability that led to the theft of approximately $70 million in BTC across 1,196 wallets. A community user independently discovered the same vulnerability using Zhipu GLM 5.2; the flaw had existed in the open-source wallet code for over five years.
AI Identifies Coldcard Vulnerability, Leading to $70M BTC Theft
AiCoinShare
Summary
Vulnerability news emerged as developers using Claude Code identified a flaw in Coldcard’s firmware within eight minutes. The issue involved a software-based pseudo-random number generator used in private key generation, resulting in a $70 million BTC loss from 1,196 wallets. The flaw had existed for over five years. A separate scan using Zhipu GLM 5.2 confirmed the same vulnerability.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.