(SeaPRwire) –   By: Ethan Gallagher

I have spent two decades evaluating hardware security for financial institutions. What happened to Coldcard users is not surprising. It is terrifying.

A Canadian company called Coinkite makes Coldcard wallets. These devices store Bitcoin private keys offline. They are air-gapped. No internet connection. No network interfaces. They were supposed to be the gold standard of self-custody.

Last week, attackers drained at least $89 million in Bitcoin from these supposedly secure devices. Not one. Hundreds of them. Across multiple users. The wallets were not cracked. The firmware was not tampered with. The attack was not on the hardware at all.

It was on the math inside it.

Rodolfo Novak, Coinkite’s CEO, put it plainly. He called it a sober reality of the new AI paradigm. His team’s random number generator produced keys that were not random enough. The algorithm had a latent flaw. A weakness in the entropy pool. Something no human auditor caught during years of public review.

AI found it. Not a nation-state hacker. Not a sophisticated syndicate with custom exploit tools. A machine scanning open-source firmware at a speed and scale no human team could match.

Here is what the official timeline tells us. Coinkite released the affected firmware in March 2021. The code was public. Anyone could read it. For three years, it sat there. Then a wave of attacks hit. Galaxy, the digital financial platform, tracked three distinct waves. They identified 1,367.05 BTC stolen. That came to about $88.6 million at the time. By Monday, Galaxy flagged a likely fourth wave. They project total losses could reach 2,055 BTC. That is roughly $130 million.

Here is what the subtext reveals. The hardware was never the vulnerability. Coldcard’s entire value proposition rested on the idea that keeping keys offline makes theft impossible. That premise just died. The flaw lived in the code that generated the keys. The code anyone could audit. The code no one caught.

This is the real lesson. Hardware security used to mean physical isolation. You kept your private keys away from the internet and you slept fine. That model is now obsolete. The attack surface shifted from the device to the algorithm running on it. AI does not need physical access. It does not need network entry. It reads code. It finds patterns. It spots weaknesses in probability distributions that humans have been missing for years.

Novak warned his customers directly. If your firmware is open-source or has ever been public, assume it is already being read by attackers and defenders alike. This is not a hypothetical. It is happening right now. The attackers did not hack a wallet. They hacked a random number generator with a language model.

The industry now faces a fundamental question. How do you secure a device when the threat no longer comes through the device? The answer will not be more air-gapping. It will not be thicker metal casings or better shielding. The answer lies in how we write, review, and validate the code that runs inside those casings.

AI can find the bugs that humans miss. AI can also fix them. The companies that survive this shift will be the ones treating AI code review as a mandatory layer of security, not a luxury. Coinkite already urges customers to update firmware and move funds to new accounts with freshly generated seeds. The damage is done. The firmware was vulnerable for three years. The question now is whether the industry learns anything from $130 million worth of losses.

Author bio: Ethan Gallagher is a Silicon Valley hardware architect and infrastructure strategist with over twenty years of experience evaluating physical security systems for financial institutions worldwide.