AI Collapses Exploit Window in Crypto Wallet Hack
A flaw in Coldcard’s wallet-seed generation reduced the randomness protecting some private keys, turning supposedly unreachable Bitcoin into a searchable target and contributing to theft running to the tens of millions of dollars
Frontier AI can radically lower the cost and time required to find exploitable software flaws
The broader risk is not that AI has broken cryptography, but that it is collapsing the window between vulnerability creation, discovery and exploitation, forcing financial institutions to move from periodic security reviews to continuous testing
Bitcoin hardware wallets were supposed to protect digital assets without the need for users to trust an exchange, bank or other intermediary
When a hardware wallet is initialized, it generates a recovery seed that ultimately controls the assets held by the wallet. That seed key is kept in “cold storage” on a device that is never connected to the internet
That means, at least theoretically, that it should be off limits to attackers
On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders. These crypto investors did what they were told to do to keep their assets safe. They moved their assets off exchanges. They bought specialized hardware. They kept their private keys disconnected from the internet. Some learned to verify firmware, memorize passphrases and generate additional randomness with physical dice
Then they lost everything. The theft did not require breaking Bitcoin’s underlying cryptography or remotely penetrating an air-gapped device. Instead, attackers appear to have identified and exploited a software defect using artificial intelligence that weakened the randomness used to generate Coldcard wallet seeds, reducing the number of possible private keys enough to make them searchable offline
See also:AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away
Implementation Risks Can Derail Even the Best Laid Cryptographies
Coinkite, the company behind the Coldcard wallet, said Thursday that because the Coldcard used frontier AI to review older firmware and uncover the issue. In effect, the flaw allowed funds believed to be protected by an almost unimaginably large universe of possible private keys to be placed inside a much smaller and searchable neighborhood
Coinkite said the problem originated in a 2021 software migration. During the integration, seed generation was routed away from Coldcard’s intended hardware random-number generator and toward a software fallback contained in a MicroPython component. The cryptographic library itself was sound. The integration was not
For banks, wallet providers and financial infrastructure firms, the incident reveals that static security reviews will no longer be enough. Code that passed an audit three years ago may need to be continually reexamined as models become better at understanding complex systems. Firmware, open-gurations must be treated as living attack surfaces rather than components certified once and trusted indefinitely
Meanwhile, after news that its models were directly responsible for an autonomous cyberattack on Hugging Face, OpenAI last week announced that it found other examples of its autonomous AI agents breaking containment, meaning the threat perimeter will remain constantly evolving
The PYMNTS Intelligence report “Scale Amplification: How Revenue Amplifies Agent-Driven Identity” showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities by adversarial fraudsters
Read also:Frontier AI Finds Cracks in the Math Behind Bank Security
AI Makes Old Code Newly Dangerous
Software vulnerabilities have always existed. What is changing is the cost of finding them
Historically, reviewing a large codebase for an obscure interaction among cryptographic libraries, embedded firmware and random-number generation required scarce expertise and significant time. Attackers had to understand the target, locate the relevant code and determine whether the flaw could be exploited economically
The April edition of PYMNTS Intelligence’s “The Enterprise AI Benchmark Report” found that 71% of executives at companies with at least $1 billion in annual revenue believe that organizational readiness is the chief limitation on AI performance. Only 11% said they think AI technology itself is the primary barrier
Financial security has long depended partly on the cost of discovery. Some weaknesses remained safe in practice because finding, understanding and exploiting them required more time, expertise or computing re
The Coldcard breach arrived as AI laboratories were demonstrating progress on problems that once required highly specialized mathematical expertise. Frontier models can compress parts of that process. An AI coding agent can inspect public repositories, follow dependencies, compare intended behavior with implementation and propose ways to test a suspected defect. It can perform that work repeatedly across thousands of software projects without becoming tired, losing focus or requiring the economics of a traditional security team.
That does not mean models can automatically compromise every cryptographic system. It means the marginal cost of searching for implementation mistakes is falling
“The time to start thinking about migrating to quantum-resistant methods of encryption is now,” Professor Scott Aaronson, scientific adviser at StarkWare, told PYMNTS in February
For all PYMNTS digital transformation and AI coverage, subscribe to the dailyDigital Transformation and AI Newsletters
