Did AI find this bug?

What Coinkite said

"we have to assume that someone used AI to review previous versions of our firmware" Coinkite, entropy technical backgrounder V1

The phrase "we have to assume" identifies the discovery claim as Coinkite's inference. The same passage separately reports that an earlier internal AI review did not find the defect. No model, transcript, prompt, discovery date or account from the original finder has been published in the sources held here.

NVK's later statement argued that AI-assisted review is accelerating discovery of latent defects and that public firmware should be assumed to receive both defensive and adversarial review. R2 That is an attributed security position, not evidence about how this defect was originally found.

On 7 August 2026 the COLDCARD account put the claim more firmly. Replying to a critic on X, it wrote: "The bug lived in public for 5yrs, even third party researchers didn't find it. We believe if took the lastest LLM models to find it." The wording is quoted as posted, typing errors included. V3 The statement moves from what the backgrounder said the company had to assume to what it says it believes, and adds a second proposition: that the defect was beyond the third-party researchers who could read the firmware across five years. Neither statement is accompanied by a transcript, model identifier or discovery date, so what is established here is the wording, not the finding.

What the post-incident tests do and do not show

In its 4 August public-record update, Coinkite said that an internal review before the incident and additional tests with frontier models after the incident did not catch the defect. R4 That evidence cuts against treating public source plus frontier-model access as sufficient by itself, but it does not show what a differently scoped or tool-assisted review would find.

Rob Hamilton separately reported that an incident-funded red team spent about US$20,000 scanning 150 repositories and produced more than a dozen private disclosures with critical findings. R5 Those were his figures on 4 August, and the campaign's own later reports are larger: on 5 August calle, coordinating the same effort, reported sixteen people, 4,962 findings across 390 projects, 85 of them critical and 635 high severity, 27.5 hours in. Bitcoin Magazine carried those numbers the same day and put the compute bill above US$40,000, funded by OpenSats. R6 Those figures describe a reported defensive campaign, not evidence about the original finder or the theft operator.

On 6 August calle added a claim about which models were doing that work: that not a single vulnerability had been found by a US frontier model, and that the effort was spending about US$10,000 a day on open-weights models, naming Kimi K3 and Qwen 3.8. R7 Hamilton's own harness description names a mixture, with K3 doing the heavy lifting and GPT Sol, Fable, Opus and GLM 5.2 in supporting roles, so the two accounts describe the same campaign from different angles rather than contradicting each other outright. Both are participants' characterisations of unpublished output.

Julián Ors supplied the corresponding false-positive warning: finding an insecure generator in source is not enough without showing that the path was reachable in shipped firmware and reconstructing the relevant release history. R8 That is a review criterion, not a finding about any particular scanner.

Early hypotheses about the operator

Kevin Loaec published an early hypothesis that the operator had asked an AI system to produce a brute-force and sweep script. R9 The observation behind it was narrower: the visible sweep searched BIP84 paths, used limited derivation depth and sometimes found only part of a wallet. Those details can inform a hypothesis about the script, but they do not identify how it was written.

Dhruv Bansal's three-post response, held as part one, part two and the third instalment, argues for multi-vendor custody and layered protections; its reference to an attacker using an LLM is part of that broader warning, not independent evidence about the operator or the original discovery method. R10

A pre-incident audit attempt is now on record

On 2 August 2026, utxoclub posted that on 17 June, roughly seven weeks before disclosure, he had pointed a large language model at the COLDCARD firmware with an audit prompt whose second listed item was a weak RNG source. The prompt did not surface the defect. R11 Two distinctions keep the claim in proportion: naming weak randomness as a category to look for is not the same as identifying this specific defect, and the post is an account of the poster's own earlier work rather than a finding published at the time.

LLFOURN examined that prompt the same day and gave two reasons for the miss: the model tier available to that account at the time, which his post phrases as a complaint about Anthropic's model gating, and the firmware repository's git-submodule structure, which keeps relevant code out of a naive checkout. R12 Both are the author's own characterisations of why the attempt failed, not measured causes.

Reproduction results after publication do not agree

Two kinds of post-disclosure result now sit side by side. Bitcoin Optech reports that several developers reproduced the attack with the assistance of frontier AI models; their prompts and transcripts are not held here. Against that, on 3 August 2026 LLFOURN began a systematic thread of prompt attempts, "for the good of science", to find what was missing from the original audit prompt. Its first data point is negative: the same prompt, run on Claude Opus 5 at the highest reasoning-effort setting, also failed to find the bug. R13

Further reported successes have accumulated on the same terms. A 6 August Bitcoin Magazine op-ed states that since the attack began researchers have shown several frontier models locating the same flaw in minutes from a single prompt, without naming them; a commenter in the 6 August r/Bitcoin thread that argues against the AI framing reports a success of his own, saying a small locally run model found the exact bug in about fifteen minutes and a few million tokens from a prompt that named no flaw; and the r/Bitcoin discovery thread's own opening post links a second reproduction on GLM 5.2. R14 Not one of them is accompanied by a prompt, a transcript or a statement of which files the model was given, which is the difference between them and the negative result above.

The two results do not test the same thing. The reported successes used prompts and context this archive has not captured; the controlled failure reused the original prompt on a stronger model. What the captured record supports is only that a stronger model alone did not turn the original prompt into a discovery. The thread is ongoing, and further data points will be held as they are posted.

How the discovery framing spread

Community venues carried the AI-discovery framing further than the captured evidence goes. An r/Bitcoin thread of 2 August is titled around Claude Code finding the vulnerability from a bare "check for vulnerabilities" prompt within eight minutes, and asserts the theft exceeded $100 million. Both figures are the thread's own: the eight-minute account does not correspond to any reproduction held in this archive, and the loss figure is not one the funds record adopts. R15 The thread is captured as evidence of how the claim circulated, not of what happened.

That thread has been edited on the source since. Captures on 6 and 7 August record comments deleted and added, among them one whose three links to earlier COLDCARD drain reports were removed and whose account now shows as deleted, and a later reshuffle in which a subthread on whether development teams should pay for AI code review became visible while several short comments disappeared. The title and opening post this page quotes are still present in the current capture; the withdrawn material is preserved in the earlier ones. V16

The framing is also contested in the same venue. On 6 August, in a thread titled "It's not an 'AI Hack'", CBpegasus argued that no evidence shows an AI found the vulnerability, that the defect is an ordinary integration mistake in which a wrong define routes execution to the wrong function, that static analysis by a language model would likely have missed it just as Coinkite's own pre-incident review did, and that a more plausible route is statistical testing of generated seeds followed by dynamic analysis of what the firmware actually executes. R17 The thread does not settle on that view: its own replies include the locally run model result noted above, a poster arguing that any model would have flagged the define that disables the hardware generator, and one saying plainly that nobody knows.

Published commentary has meanwhile adopted the framing as a premise. Casa, a competing collaborative-custody provider whose post closes by offering free consultations to people moving off an affected COLDCARD, wrote on 6 August that researchers now believe the vulnerability was most likely found by a frontier model, and that whether the attribution is ever confirmed does not matter, because it is plausible today and will be normal tomorrow. R18 The post names no researchers, and its own text treats confirmation as unnecessary. That is commentary on the claim, not evidence for it.

Public source and whether it was ever a defence

Underneath the discovery question is a second dispute the incident reopened: whether publishing the source was supposed to prevent this, and what the licence had to do with it. Coinkite's own 7 August wording, quoted above, puts one position — the bug lived in public for five years and third-party researchers did not find it. Three published responses pull in different directions. This archive sets them beside each other and does not adjudicate.

Colin Crossman's 6 August Bitcoin Magazine op-ed, a guest post whose author is identified there as Wyoming's Deputy Secretary of State, argues that the licence never bore on readability: Coinkite's move from a free-software licence to source-available terms, made in his account after another vendor used the code in a competing product, changed the economics of finding the bug rather than the ability to read it, because a machine that decompiles a binary is unaffected by what a licence permits. He also puts the plainer point that the code was open to human review for five years and, on his reading, no human caught it, and describes Coinkite's AI-discovery assumption as its working position "with wide agreement on X". R19

Ledger, a competing hardware-wallet vendor, published its CTO on 7 August arguing the reverse emphasis: that open source is valuable but is not a security property, and that a security model resting on "the crowd will save us" is "a hope" rather than a model. R20 Casa's post makes the observational version of the same point about this firmware: the source was viewable throughout, reviewers confirmed the hardware generator existed, and nobody checked whether the seed path called it correctly. R21

The community version of the question is held here too, and part of it has since been withdrawn. The r/coldcard thread asking whether COLDCARD is really open source, and whether the code was locked away or merely unread, shows its opening question as removed at source in the 7 August capture; the title and replies remain, and the question as originally posted is preserved in the earlier captures. V22 The licence terms themselves, and the forkability question they raise, are recorded on the developer-response page rather than here. What the captured record establishes on this page's question is narrower than any of the positions above: the source was public throughout, and no held source identifies anyone who found the defect in it before the theft. U23

Claim register

A worked human route to the same path

The manual route stopped being hypothetical on 1 August 2026, when bitcoin++ Insider Edition published Dustin Dettmer's commit-history walkthrough. Working from the public repository, it reaches the board override, the disabled macro and the symbol the seed path actually calls, and it credits no model assistance. V28 What it reconstructs is summarised on the developer-response page. U29