Hostile AI auditors eliminate security patch windows

Other (9)

• David Bennett states Coldcard models Mark III, Mark IV, Mark V, and Q with firmware 4.x+ were compromised by a predictable seed generation vulnerability, while firmware 3.x models appear unaffected. The flaw, active since 2021, stemmed from a software error that reduced entropy from 2^256 to approximately 2^32 bits, making wallet seeds easily guessable.
• Bitcoin began moving from affected Coldcard addresses around July 30th, 2026, via coordinated, automated sweeps targeting large balances first (over 1.15 BTC), then smaller amounts in subsequent waves. Attackers could generate candidate seeds and compare them to the public blockchain without direct access to devices.
• CoinKite initially dismissed public warnings, continued to sell affected products for 48 hours after the vulnerability was known, and later released a firmware update that reportedly bricked devices. David Bennett argues CoinKite's failure is inexcusable and recommends never using their products again, including OpenDimes and BlockClocks.
• Volunteer teams, including BTC Sessions and Rob Hamilton, provided extensive support to affected users, with BTC Sessions reporting efforts protected "tens of millions of dollars." Foundation Devices also assisted Coldcard users, highlighting a community-driven "immune system" approach to crisis.
• David Bennett advises immediately migrating funds from any CoinKite product; he suggests using centralized exchanges like Coinbase or Kraken as a temporary measure if other self-custody options are untrustworthy or unavailable. He emphasizes avoiding panic and performing test transactions.
• David Bennett describes this incident as a "crossing the Rubicon" moment, where AI's ability to automate exploit discovery against vast code repositories means continuous, daily security audits are now essential. He suggests this creates a "security moat," raising costs for smaller projects.
• David Bennett proposes "swarm audits" where community members pool resources (AI tokens, compute, human review) to continuously vet open-source codebases. He successfully used Grok to audit Bitbox 02 Nova's code, underscoring the potential for collective vigilance.
• A "second layer" of sophisticated phishing attacks emerged, using truthful information about the Coldcard vulnerability, legitimate links, and urgent calls to action to trick users into revealing seed phrases or installing malicious software. David Bennett warns no legitimate manufacturer will ever ask for a seed phrase.
• David Bennett places sole blame on CoinKite founder Rulo Novak for the "shitty code" and systemic failure, rejecting attempts to extend liability to influencers like Matt Odell or Marty Bent, who are investors in CoinKite through their firm 1031.

Custody (6)

• A critical vulnerability in Coldcard hardware wallets (versions 4.0.1 and later, or any model after 4.0.0) compromises private keys due to a faulty random number generator.
• The catastrophic Coldcard bug, introduced in March 2021, compromises seeds generated on any device after that date unless sufficient dice roll entropy (over 100 rolls) or a passphrase was used.
• Hosts advise all Coldcard users to immediately move their funds off the devices and to cease using the product entirely, regardless of previous protective measures like passphrases or multisig.
• The hosts had previously conducted Coldcard workshops since December 2019 at Chaincode Labs with figures like Evan Kaludis and James O'Byrne, demonstrating features like dice rolls and passphrases.
• Hosts concede to complacency, having placed too much trust in CoinKite's NVK and Peter; they now believe the concept of a "magic bullet" beginner-friendly solution for high-value self-custody is dead.
• The hosts will now refrain from directly recommending specific custody solutions, instead laying out options and emphasizing multi-vendor multisig and robust passphrases as critical for long-term secure Bitcoin storage.

Media (2)

• The hosts express deep regret and take accountability for recommending Coldcard for seven years, admitting their past confidence was misplaced despite consistently advocating "don't trust, verify."
• The Coldcard vulnerability was publicly disclosed on August 3, 2023, at Bitcoin block height 960885, prompting hosts to release this podcast immediately to maximize user notification efforts.

Safety (4)

• The Bitcoin community has rallied to assist affected users, with Rob Hamilton (@Roboneham on X) publishing an extensive guide detailing Coldcard vulnerabilities, migration options, and recovery steps.
• Attackers are actively brute-forcing compromised Coldcard seeds using GPUs, while authorities are investigating an attacker who reportedly pinged a centralized API provider to look up vulnerable addresses.
• The hosts clarify the vulnerability is entirely CoinKite's responsibility, stating their firm 1031 is a minority investor (under 10%) with NVK and Peter maintaining majority ownership and control.
• Users are strongly advised not to update Coldcard firmware, as new releases may brick devices; instead, the immediate priority should be transferring all funds off the compromised hardware.