Coldcard maker says AI code review missed its bug

Coinkite, the maker of the Coldcard hardware wallet, said it tested its firmware code against several frontier AI models before the vulnerability behind an estimated $130 million in thefts was exploited, and none of them caught it. The flaw sat in firmware version 4.0.0, live since March 2021, where the device bypassed its dedicated hardware randomness chip during key generation and substituted a predictable software routine instead.

The company said the bug lived at the boundary between two separate software components, a part of the codebase that receives less scrutiny than core cryptographic logic. Coinkite has since shipped fixed firmware and is recommending that other teams relying on AI for security review test those tools specifically against build and sub-module boundaries, not just the code paths reviewers usually focus on.

A bug invisible to both human reviewers and AI models for five years argues for treating AI code review as one layer of defence rather than a substitute for it.