Coldcard Losses Climb Past $100M

Weeks before the theft, Coinkite ran an AI review over its firmware — the open-source code anyone can read. It found nothing. Then, it believes, an attacker pointed AI at older versions of that same code and found the flaw that drained tens of millions.

The truth, as engineers are pointing out, is that this was a mundane bug. A build setting had quietly swapped real randomness for a predictable fallback — the sort of thing a human should have caught. But "a human should have caught it" and "AI just changed the economics of finding it" aren't in conflict, and the second is the part that's new.

An audit was always a photograph of what the best adversary could see on the day it was taken. What changed is that the adversary can now read every line of public code cheaply, tirelessly, at scale — and only has to win the race once.

Open-source was meant to make bugs shallow: many eyes, fewer hiding places. It still might. But the eyes that matter now are machines, they're getting sharper every few months, and they don't all report to you. The defender has to find every flaw. The attacker needs one. That maths didn't start with AI — AI just dropped the price of playing the attacker's side.