Coldcard vulnerability leads to $130M loss; Ledger calls for AI-driven security upgrades

Odaily Planet Daily reports that hardware wallet manufacturer Ledger has stated that the recent Coldcard vulnerability highlights the need for the hardware Bitcoin wallet industry to reevaluate its security model. Ledger CTO Charles Guillemet said that Ledger devices are unaffected, as their recovery phrases are generated by a certified secure element with an integrated hardware random number generator. Coinkite, the manufacturer of Coldcard, disclosed last week that its air-gapped Coldcard Bitcoin hardware wallet contains a vulnerability dating back to firmware versions from March 2021. The flaw, which uses a software rollback mechanism to generate wallet recovery seeds, has allowed some private keys to be guessed, resulting in estimated losses of approximately $130 million. Coinkite has since released a patched firmware on Sunday and urged affected users to transfer their funds to newly generated wallets. Charles Guillemet noted that open source does not equate to reviewed; this vulnerability existed in publicly accessible code for over five years, and AI is now enabling attackers to scan code and identify flaws at machine speed. Charles Guillemet also stated that over the past two years, Ledger has integrated AI with security engineers and cryptography experts to review code and detect vulnerabilities. He emphasized that users evaluating hardware wallets should understand how randomness is generated and whether this process has received independent certification.