1 hr ago3 min readColdcard ships firmware after $114 million bitcoin theft. (Coinkite)SummaryCoinkite has released new firmware for its Coldcard hardware wallets after a randomness flaw enabled attackers to steal more than $114 million in bitcoin, but compromised wallets still require new seeds and fund migration.The company used AI tools, including frontier models, to audit its entire system, leading to fixes in transaction approval, USB data handling and firmware validation, and it now requires users to generate seeds with physical randomness such as dice rolls or coin flips.The Coldcard update comes amid a broader shift toward AI-assisted security across the bitcoin ecosystem, with projects like BTCPay Server, major exchanges and the volunteer Bitcoin Red Team reporting that AI-driven reviews are uncovering critical bugs at far higher rates than manual audits.Coinkite, the Canadian company behind the Coldcard hardware wallet, has released new firmware weeks after disclosing the flaw that let attackers drain more than $114 million from bitcoin holders.The company said the review behind it was AI-assisted, naming Kimi and other frontier models among the tools used to examine not just the faulty randomness code but the whole system. That review found problems unrelated to the original bug in the way transactions are approved, how data is handled over USB and how firmware updates are validated.Installing the update does not make an existing compromised wallet safe. Anyone whose seed, or the master key that controls a wallet's coins, was created on affected firmware between 2021 and July 2026 still has to generate a new one and move their money across.New seeds now work differently. Every one requires the owner to supply the randomness by hand, either 65 key presses at unpredictable intervals, 50 rolls of a six-sided die, or 128 coin flips. Physical randomness is used because a die or a coin produces results no software can predict, while the flaw that caused the theft was in the device generating randomness by itself, as CoinDesk previously explained.Underneath, Coinkite replaced the backup random number generator entirely, swapping an algorithm called Yasmarang for one built on SHA-256, the hashing function bitcoin itself uses.How Coldcard generates a seed, before and after the fix. (Shaurya Malwa/CoinDesk) The device now re-checks a transaction immediately before signing it, so a computer compromised at the USB port cannot alter a payment after the owner has approved it on screen. sSgnature modes that leave parts of a transaction editable after signing are now blocked by default.Law enforcement is still investigating the thefts and working to identify those responsible, the company said, and it remains available to assist.Coinkite is asking owners of its Mk4 and Mk5 devices to install version 5.6.1, and owners of the newer Q model to install 1.5.1Q, from its official downloads page only. It has also launched a public status page listing which releases are fixed and what migration steps apply.How AI is helping catch bugsColdcard is the fifth bitcoin or crypto outfit in three weeks to say publicly that AI has changed how security work gets done.BTCPay Server, free software merchants run themselves to accept bitcoin payments, was hit this month when attackers drained Lightning nodes belonging to its users through a flaw it had just patched. The project is offering a bounty of up to 3 BTC for the return of the money and has paid 0.42 BTC to the researchers who found the flaw, while telling merchants to keep funds in cold storage and move excess out of hot wallets regularly, "especially during this period of rapid, AI-driven change."Dozens of bitcoin firms including Coinbase, Block, BitGo and Blockstream signed an open letter on Aug. 10, as CoinDesk reported, asking AI labs to give open-source security researchers early access to their most capable models.A volunteer effort has been the most visible of the three. The so-called Bitcoin Red Team, a collective of sixteen developers working across time zones, filed 4,962 findings against 390 projects in its first 24 hours, including 85 critical and 635 high-severity issues, and produced the report behind BTCPay's patch.Crypto exchange Bybit, which lost roughly $1.46 billion to North Korea's Lazarus Group in February 2025, said this week that AI-assisted auditing found high-severity flaws at three to five times the rate of manual review, and helped it block a mammoth $700 million in suspicious withdrawals across the first half of the year.12345678910Anvil: The Missing Collateral LayerAnvil: The Missing Collateral LayerAnvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.Jul 29, 2026Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.Why it matters:Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.View Full Report