Bitcoin Magazine reports that more than 1,000 bitcoins are believed to have been stolen in a hack first discussed on social media on the afternoon of July 30. Coinkite, a hardware wallet manufacturer best known for its Coldcard line of Bitcoin-only devices, was found to have a critical bug in the way its hardware wallets generated secure private keys, and industry experts believe AI may have been used in the breach.

Coldcard MK3 devices running firmware versions 4.0.1, released in March 2021, through 4.1.9 are considered the most affected. 12- or 24-word seeds generated by the device are vulnerable if they did not include user-generated dice rolls or a BIP 39 extra passphrase — an optional additional word or phrase that acts as a twenty-fifth seed word, creating a separate wallet layer on top of the standard seed.

Users who fit that description and hold bitcoin in an MK3 Coldcard should treat their funds as at risk and move them as soon as possible. Bitcoin Magazine technical writer Shinobi has published a guide on the issue, and Coinkite has also published a guide and advisory.

The vulnerability was tied to a specific line of code in the firmware, the low-level software that controls the hardware. The firmware appears to be upgradable. Coinkite updated its advisory on the morning of July 31 and said fixed firmware is now available for all three device lines, including MK3, MK4, MK5, and the Coldcard Q.

Coinkite wrote: “Updated July 31, 2026 at 9:33 a.m. EDT: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. For Mk3, update to version 4.2.0 or later.”

The company also said updating firmware does not make private and public keys generated by the vulnerable firmware secure retroactively. Those keys remain vulnerable because they were effectively created with a weak password. After updating, users must create a new wallet and move funds onchain to new addresses in order to secure them.

Coinkite said: “Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.”

Some Multisignature Wallets May Be at Risk

Peter Todd, a Bitcoin Core contributor and cybersecurity engineer, addressed edge cases involving multisignature wallets that use multiple Coldcards to secure funds.

He gave this example: “Example case: you have a 2-of-3, with 2 Cold Cards, and a 3rd uncompromised device. If you move your funds, the moment your script is revealed for the first time – previously hidden behind the address hash – the attacker now knows enough to use the compromised 2 cold card keys to steal your funds.”

Todd said the transaction that reveals the multisig script may be unconfirmed, which could give attackers enough time to create a competing transaction with a higher fee. He said the MARA mining pool may help in such cases through its private mempool mining service, Slipstream — a service that accepts transactions directly and broadcasts them only once included in a mined block, keeping them off the public mempool where attackers could observe them. He cited the service “because they promise to keep your transaction – and thus pubkeys – secret until they’re already in a block. Dramatically reducing the ability of the attacker to steal the funds.”

He added: “If you’ve already reused addresses, this isn’t relevant, and you should just try to move your funds ASAP. But if you haven’t, MARA may be able to help.”

Beyond the Immediate Crisis

NVK, one of Coldcard’s co-founders, published a long post on X offering an initial analysis beyond the immediate steps needed to secure funds. He said the company is “committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation,” including providing “a written incident summary specific to your loss and any transaction data we can share.”

NVK also pointed to a broader shift in technology as AI changes cybersecurity expectations. He wrote: “To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it’s already being read by attackers and defenders alike.”

The hack and the more than $70 million in estimated stolen funds over the past 24 hours are effectively a bounty for hackers now likely auditing wallet codebases for vulnerabilities. While the Bitcoin and broader crypto industry has long assumed attackers will test code, AI models optimized for cybersecurity appear to be accelerating that process. The breach ranks among the larger cryptocurrency thefts measured in bitcoin, and the fact that it targeted hardware wallets — widely regarded as one of the most secure self-custody methods — has heightened concern across the industry.

Industry experts gathered in a long X Spaces call on Thursday night to discuss the issue for several hours. In addition to answering questions from Bitcoin users, the discussion also covered what may follow in the coming weeks. Other wallet providers are likely to be probed, especially open source projects that generate private key material.

The X Spaces was not recorded, reportedly to preserve the privacy of participants. Initial sentiment from the call suggested that companies will need to audit their code with the latest frontier models as a matter of survival. AI cybersecurity models from Anthropic, OpenAI, Moonshot’s Kimi K3, and others are already publicly available. Many companies in the Bitcoin industry already use such tools to test code integrity, but some may not, and the search for vulnerabilities in wallet-facing code is expected to continue in the weeks ahead.

The broader conclusion, as framed by participants, is that the industry is entering a period of introspection and careful review after what is now being described as a historic hack. The open source self-custody sector and related infrastructure may emerge far more secure after difficult lessons are absorbed, especially as attackers with AI agents continue testing defenses.

Multi-vendor, Multi-key Wallets and Covenants

Future high-sovereignty wallets, whether for retail or corporate use, are likely to avoid reliance on any single vendor. Properly designed multisignature wallets can distribute vulnerability risk across different code bases, teams, and hardware.

User-generated entropy was also a major topic in the X Spaces, with dice-roll entropy discussed as one possible safeguard. Coldcards and other hardware wallets such as Foundation Devices provide guidance on how to add user entropy properly, often requiring many dice rolls, ideally well over a hundred individual rolls. Once done, dice rolls provide a non-software source of randomness and help separate users from edge-case risks in software- or hardware-generated entropy.

Covenants, a soft fork proposal popular among a niche of the Bitcoin industry, were also raised as a possible next step for strengthening self-custody infrastructure. If ever adopted, the consensus upgrade could give users additional smart contract capabilities, such as a wallet that can only send to a whitelist of addresses, something that is not possible in Bitcoin script today.

This article first appeared on Bitcoin Magazine and is written by Juan Galt.