Over the past several days, Bitcoin holders who followed every recommended security practice still lost their funds. They purchased a respected hardware signer, generated a seed phrase offline on that device—the standard BIP39 method for creating Bitcoin keys, designed to encode 128 to 256 bits of randomness—and relied on it to fulfill the single most critical function a signer exists to perform: produce a number no one else can guess.

The Coldcard hardware signer failed to do that. A preprocessor guard that checked the wrong condition quietly diverted seed generation to a weak software pseudorandom number generator—MicroPython's Yasmarang—rather than the device's hardware entropy source. On certain Coldcard models, the effective entropy collapsed to approximately 40 bits—roughly one trillion possible seeds, a search space small enough to enumerate with consumer hardware, and a reduction of over 200 bits from the intended security level. The flaw was introduced in March 2021 and remained present in publicly readable firmware for more than five years.

Attackers swept 500 addresses before the root cause was understood. Within days, Galaxy Research's tally had reached 4,585 addresses and nearly $90 million in losses. The attack remains ongoing as of the date of this article.

Coinkite, the manufacturer of Coldcard, operates under the working assumption—widely shared on X—that the attacker used AI to comb through publicly available firmware to discover the bug. Whether or not AI was used in this specific instance, the next attacker will almost certainly employ it. Notably, an AI-assisted audit conducted weeks before the theft detected nothing, potentially due to the model's limitations or the specific construction of the search. Since the attack began, researchers have demonstrated that several frontier AI models can locate the same flaw in minutes from a single prompt.

The code sat open to human review for five years, and no human caught it.

License Changes That Changed Nothing

Coinkite had previously moved its firmware from a free-software license to source-available terms—specifically, MIT with a Commons Clause—after Foundation Devices incorporated the code into a competing product. Under the revised terms, users could read the source code but could not build a business on it.

This change had no effect on security. The bug resided in code that a machine could read regardless of licensing restrictions. In fact, it entered the codebase in the very rewrite that stripped out the last remnants of GPL-licensed code. The license modification did not enhance protection; it merely altered the economics of finding the vulnerability.

The Illusion of Closed Source

In the age of increasingly capable AI, everything that is distributed is readable—or soon will be. Stripping a binary of its symbols and running it through a decompiler produces the pseudo-C output familiar to anyone who has opened Ghidra, a widely used reverse-engineering suite originally developed by the NSA: nameless variables, flattened control flow, functions labeled FUN_00401a20. For most people, this output is unreadable. That high barrier to human comprehension was the entire security premium of "closed source."

A compiled program, however, has no choice but to tell the truth. Code that remains encrypted cannot run. At the moment of execution, the processor must receive the actual instructions, so whatever a program does, it hands the machine a complete and exact account of how to do it. The information is fully present in the machine code. Obfuscation does not, and cannot, remove it.

If reading a binary sounds too difficult for machines to master in the near future, consider what they are already accomplishing with problems far harder. Reading a binary is an exercise in analysis: every necessary fact is present, and the work is extraction. Mathematical invention represents another order of difficulty entirely, because it demands the creation of an object no one has ever seen.

At 02:19 UTC on July 20th, Levent Alpöge, a mathematician working with Anthropic's Claude Fable 5, posted a counterexample to Keller's Jacobian conjecture—a problem that had remained open since 1939 and was significant enough to appear on Stephen Smale's list of challenges for the twenty-first century. Generations of mathematicians had attempted it. The disproof consists of three polynomials in three variables. Lean verified it within hours, and it is short enough for anyone to confirm in a computer-algebra system in approximately one minute.

The Jacobian conjecture fell in a single afternoon, while the questioner was apparently watching the final match of the FIFA World Cup. In May, an OpenAI model toppled the Erdős unit-distance conjecture, a question open since 1946. In late July, a 30-year-old graph-theory conjecture fell to four prompts. Between those milestones came the Jacobian disproof and a series of other results that had stood for decades.

Set that pace of progress alongside the comparatively modest task of reading machine code already published on the Internet. Today's models handle source code and decompiler output more effectively than raw bytes, so a fully closed binary retains only a thin margin of protection. That margin functions as a cost speed bump, and it is eroding at the same pace visible across every other domain. Betting security on how long it lasts means betting against a clock that is only accelerating.

The Quieter Casualty: Trade Secrecy

The same AI capability that finds an entropy bug can read proprietary methods. This is the quieter casualty, and it affects companies that never considered themselves exposed to open-source dynamics. Trade secrecy in shipped software was always simply obscurity in formal dress.

The law has acknowledged this for as long as trade-secret law has existed. Reverse engineering a product you lawfully possess is fair play, and therefore a secret survives only as long as that reverse engineering remains expensive. When the cost of extraction falls to the price of a subscription and a prompt, the secret embodied in the code distributed to customers ceases to be one. Proprietary algorithms, undocumented formats, competitive edges embedded in binaries—all become legible to anyone who cares to look, on a timeline increasingly measured in minutes.

Open Source Is Not a Guarantee

None of this necessarily makes open source safe. Heartbleed hid in the most widely deployed TLS library on earth for two years, because visibility without funded attention finds nothing. The xz backdoor demonstrated that the open contribution model is itself an attack surface—one that a patient adversary can traverse with a friendly persona and two years of legitimate-looking commits.

Openness once served as a shield, but it no longer does. What it does provide is reviewers who are permitted to examine the code, builds that can be independently reproduced and verified, an exit strategy when a vendor dies or pivots, and acknowledgment that all of this will happen regardless of preference.

The Defender's Advantage

We must now assume that every line of code shipped will be read by someone with malicious intent, because it will be. The defender holds one structural advantage the attacker never will: time. Developers can apply the same frontier models to their own code before release, during the interval between commit and ship, while the attacker waits for a binary that does not yet exist.

Builds should be made reproducible—meaning anyone can compile the same source and verify that the resulting binary matches what was shipped, byte for byte—so that each binary ties back to source code that can be independently checked. Systems should be designed to fail closed, and the trusted core should be kept small enough that a single bug cannot compromise everything.

For those specifically holding Bitcoin, the lesson Coldcard is teaching in real time is clear: own the entropy you cannot afford to have guessed, keep the secure element minimal and behind a published interface, and distribute keys across independent implementations—so that no single device and no single vendor's mistake constitutes the entirety of your exposure.

Permanent Consequences

For Bitcoin, the stakes are unforgiving in a way they are not in other domains, because mere knowledge of private keys grants full possession of funds. The entropy bug has left permanent scars. Patching the generator does nothing for the seeds it already produced; a weak keyspace remains sweepable forever, and disclosure hands the attacker the recipe.

This pattern has been observed before. The Milk Sad vulnerability in the libbitcoin explorer tool, bx, seeded private keys from a 32-bit value, and attackers were draining the wallets it produced before the flaw was ever publicly disclosed. Attackers keep their own schedule, invited or not. For money that cannot be recovered once spent, "findable eventually" is a synonym for "gone eventually."

The Standard Bitcoin Already Set

Bitcoin never relied on obscurity. The protocol is open, its rules are verifiable by anyone, and its security rests not on secrets but on mathematics and incentives that hold in full public view. The hardware and software built around it deserve the same standard, because the alternative is no longer viable.

The choice was never between open and closed. It was between disciplined and exposed.

The broader lesson of the Coldcard situation is that closed-source software is like a seed generated by a broken Coldcard: it may appear sound, but it is fundamentally built on sand. Everyone can read the code. The only remaining question is whether developers acknowledge that fact voluntarily—or whether they and their users learn it the way Coldcard's users did, one drained address at a time.

*This is a guest post by Colin Crossman, a content producer at Fedi. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine. This post first appeared on Bitcoin Magazine.