The reason behind the large-scale theft of @COLDCARDwallet hardware wallets seems absurdly negligent: Someone used AI and found the critical vulnerability hidden in the code for five years—in just eight minutes. A Reddit user instructed Claude Code to audit Coldcard’s open-source firmware, giving only a brief command: “Check for vulnerabilities.” Eight minutes later, Claude directly identified the issue: the firmware was using a software-based pseudo-random number generator to create private keys, instead of the hardware’s true random number generator (see image below). This was precisely the flaw exploited by hackers to empty over a thousand wallets. Even more astonishing, it wasn’t just Claude that found it. Someone ran the same analysis using Zhipu’s GLM 5.2—and it found the same vulnerability. GLM 5.2 was trained on a version dated June 16 and had no internet access, so it couldn’t have learned about the vulnerability from news reports. It detected it purely by analyzing the code. In other words, this bug required no advanced expertise to uncover—it was a basic error visible with a simple AI code scan. This raises the question: how laughable has code auditing become? Conversely, consider this: if a malicious actor with even basic technical skills were to use AI to indiscriminately scan all wallets and DeFi-related software and hardware for vulnerabilities—how many more such flaws might they uncover? 😱 Note: This is not a tutorial for hackers—it’s a wake-up call for project teams to defend themselves.