Coldcard

A critical firmware flaw in Coldcard hardware wallets allowed attackers to drain roughly $130 million in Bitcoin by exploiting a weak random number generator. In response, investors moved over $15 billion worth of BTC into more secure, often multisig, storage environments.

A volunteer group known as the Bitcoin Red Team used AI-driven scanning to detect thousands of security vulnerabilities in Bitcoin ecosystem projects. The findings highlight a growing trend where automated tools can rapidly identify critical flaws in cryptographic and payment software.

The non-custodial Bitcoin swap service Boltz has halted all services because AI-driven attacks are discovering vulnerabilities faster than the team can deploy fixes. While no user funds were compromised, the company warns of a significant paradigm shift in how attackers target open-source Bitcoin infrastructure.

A significant vulnerability in Coldcard hardware wallets' firmware led to a massive reduction in entropy, enabling attackers to steal over $100 million in Bitcoin. The flaw has prompted the cryptocurrency community to move away from trusting hardware-based random number generators in favor of auditable, physical entropy methods like dice rolling.