Skip to Content Subscribe Our Offers My Account Manage My Subscriptions FAQ Newsletters Canada Canadian True Crime Canadian Politics Health World Israel & Middle East Financial Post NP Comment Longreads Puzzmo Diversions Comics NP News Quiz New York Times Crossword Horoscopes Life Eating & Drinking Style Sponsored Play for Ontario Travel Travel Canada Travel USA Travel International Cruises Travel Essentials Culture Books Celebrity Movies Music Theatre Television Business Essentials Advice Lives Told Tails Told Shopping Buy Canadian Home Living Outdoor Living Kitchen & Dining Tech Style & Beauty Personal Care Entertainment & Hobbies Gift Guide Travel Guide Amazon Prime Day Deals Savings National Post Store More Sports Hockey Baseball Basketball Football Soccer Golf Tennis Driving Vehicle Research Reviews News Gear Guide Obituaries Place an Obituary Place an In Memoriam Classifieds Place an Ad Celebrations Working Business Ads Archives Healthing Epaper Manage Print Subscription Profile Settings My Subscriptions Saved Articles My Offers Newsletters Customer Service FAQ Newsletters Canada World Financial Post NP Comment Longreads Puzzmo Diversions Life Shopping Epaper Manage Print Subscription HomeNewsCanadaWorldHacked Canadian bitcoin company warns others relying 'on open-source code' that AI security failedCoinkite Inc., whose wallet users lost an estimated US$130M, said the vulnerability the hackers discovered 'is a warning for every company building Bitcoin hardware and software, not only us'Author of the article: You can save this article by registering for free here. Or sign-in if you have an account.An AI software failure led to an estimated US$130 million stolen from users of a Canada-based Bitcoin wallet maker, according to the company. Photo by Jean Chung /BloombergThe company at the center of a Bitcoin hack has warned that artificial intelligence failed to detect the software flaw that was exploited to steal users’ funds, now estimated at US$130 million.Enjoy the latest local, national and international news.Exclusive articles by Conrad Black, Barbara Kay and others. Plus, special edition NP Platformed and First Reading newsletters and virtual events.Unlimited online access to National Post.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles including the New York Times Crossword.Support local journalism.Enjoy the latest local, national and international news.Exclusive articles by Conrad Black, Barbara Kay and others. Plus, special edition NP Platformed and First Reading newsletters and virtual events.Unlimited online access to National Post.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles including the New York Times Crossword.Support local journalism.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one account.Share your thoughts and join the conversation in the comments.Enjoy additional articles per month.Get email updates from your favourite authors.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one accountShare your thoughts and join the conversation in the commentsEnjoy additional articles per monthGet email updates from your favourite authorsSign In or Create an AccountorCanada-based Coinkite Inc., whose affected Coldcard wallets were drained late last week, said the vulnerability the hackers discovered “is a warning for every company building Bitcoin hardware and software, not only us.” Firms using AI to monitor security-critical code should undertake immediate reviews, Coinkite said in a blog post on its website.“If your team relies on AI review of security-critical code, we recommend you test it specifically against build and sub-module boundaries,” Coinkite said. “We believe many Bitcoin projects, including those that rely on open-source code, require immediate review.”Get a dash of perspective along with the trending news of the day in a very readable format.By signing up you consent to receive the above newsletter from Postmedia Network Inc.A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of NP Posted will soon be in your inbox.We encountered an issue signing you up. Please try againThe Coldcard hack has unnerved crypto investors because so-called “hard” wallets, which use physical hardware to store private keys and are not connected to the internet, are considered one of the safest ways to secure digital tokens. The breach has put scrutiny on self-custody, one of crypto’s founding principles.“Self-custody is a hallmark of digital assets, but Coldcard shows how one point of failure can shake trust in the whole model,” said Nikhil Raghuveera, chief executive officer of Predicate, a blockchain compliance infrastructure provider. “The repercussions could be long-lasting because the ecosystem is built on the promise of being trustless. Over time, the bigger risk is that investors move away from digital assets entirely.”Following the hack, roughly 728,000 Bitcoin wallets moved funds in a single day, according to Ki Young Ju, founder of CryptoQuant. The rush to move the tokens was significant enough to push down the “mean coin age,” a measure of the average number of days tokens have remained dormant, for the first time this year, he wrote in a post on X.“The excess likely reflects a move to safer storage,” he wrote.Galaxy Research estimates that four suspected attack waves in the Coldcard hack have resulted in losses of about $130 million, according to its latest analysis.Coinkite said the bug appears to have lived in the part of the firmware where two separate software components interact, not in the parent code or cryptographic logic that are subject to most reviews.It’s important for the broader ecosystem to understand how the bug arose and why it evaded detection, “so they can avoid similar consequences,” it said.“We’ve run AI-assisted review against our critical codebases, including in the weeks before the exploit,” Coinkite said. “It did not catch this vulnerability.”Since the incident, Coinkite has tested its code against several frontier AI models, and “none of them caught it,” the company said.“It’s a reason for us, and anyone else relying on AI tools, to be specific about what they currently catch and what they might not.”Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our daily newsletter, Posted, here. Join the Conversation This website uses cookies to personalize your content (including ads), and allows us to analyze our traffic. Read more about cookies here. By continuing to use our site, you agree to our Terms of Use and Privacy Policy.