Coldcard key exploit drains $38M 😱

A vulnerability in the hardware wallet's seed generation enabled attackers to scoop 594 BTC from 500 wallets inside 25 minutes.

Author

Stephen Graves
July 31, 2026

📝 What you need to know

Hardware wallets are routinely touted as the ne plus ultra of crypto security. That reputation took a body blow Friday when Coldcard disclosed an advisory that its wallets were vulnerable to a flaw in the key generation mechanic, making seeds more guessable than intended. The warning came too late for some 500 wallets, which were drained of $38 million in Bitcoin across just 25 minutes.

The wallet’s manufacturer, Coinkite, said it was likely the attacker had “used AI to review previous versions” of its open source firmware, in what could be the latest example of frontier AI being used to exploit crypto vulnerabilities. It comes just days after Zcash activated its Ironwood upgrade in response to a security researcher uncovering a critical flaw in its Orchard privacy pool.

It’s a worrying time for crypto holders as firms rush to audit their code, and mull whether the open source model that previously provided security assurances is now an attack surface for AI.

$38M in Bitcoin Drained by Coldcard Key Flaw Its Maker Thinks AI Found

Coinkite said it’s likely that an attacker used AI to review previous versions of its open source firmware to uncover a vulnerability.

Bitcoin · BTCJuly 31, 2026
$62,765
▼ 2.9% past 24 hours
View live price

📰 In the News

Circle Lands New York Trust Charter as Stablecoin Issuer Expands Regulatory Footprint

The approval comes weeks after Circle won federal approval to establish a national trust bank, adding another license for the USDC issuer.

Coinbase Misses on Q2 Earnings as Crypto Trading Activity Slows

Coinbase reported lower quarterly revenue and a net loss as crypto trading activity declined, while subscription and lending grew.

Crypto Exchange Luno Cuts Global Staff By a Fifth, Citing Automation

CEO James Lanigan cited automation reshaping the business, as the exchange shifts from retail trading toward institutional infrastructure.

XDC AI and the Rise of Agentic Finance: When AI Agents Learn to Pay

As AI agents move from giving advice to making transactions, a new layer of payment infrastructure is racing to catch up.

Brought to you by XDC Network

📊 Myriad Insight of the Day

GPT-6 released by __?
July 1%Aug 20%Sep 44%35% After
    
Why it matters
The market has repriced meaningfully in three weeks: the August marginal dropped from 42% to 20%, while September grew from 27% to 44%. Traders now overwhelmingly expect a September GPT-6 release rather than August. OpenAI's GPT-5.6 Sol shipped July 9; fresh leaks suggest an interim GPT-5.7 launch in August ahead of GPT-6, per WinCentral. Volume has grown 4.5x to $143K since publication.
Trade

🕵🏻‍♀️ Editor’s Picks

AI Company Sues Town for Trying to Block Data Center Near National Park

A proposed $4.8 billion AI data center near Mammoth Cave National Park has sparked a legal battle between the developer and the town.

Claude Hacked Three Companies in Internal Testing: Anthropic

Anthropic says three Claude models compromised the companies after a testing misconfiguration exposed the AI to the public internet.

Treasury Secretary Invokes Bitcoin Creator Satoshi Nakamoto in Plea for Clarity Act

Scott Bessent urged the Senate to vote on the Clarity Act, ending his appeal with a quote from Bitcoin creator Satoshi Nakamoto.

🥇 Be First to Market With Myriad

Join the Myriad Markets Telegram to see the latest prediction markets the second they drop!

With Myriad, the on-chain prediction market launched by Decrypt’s parent company DASTAN, you can break the news and stake the news.

📚 Watch & Learn

📹 WATCH: Macro Markets, Memory vs Crypto, & WTF Is Stonkbroker - Special Guests: OSF & SimpleFarmer

🎓️ LEARN: What Is AI Jailbreaking? A Beginner's Guide to the Cat-and-Mouse Game Behind Every Chatbot

Jailbreaking went from cracking iPhones to liberating LLMs. Here's how it works, who's doing it, and why every AI lab is losing sleep.

Interested in partnering with Decrypt? Find out more here.