About 1,816 BTC were transferred out from over 5,200 addresses, as a Coldcard firmware vulnerability bypassed the hardware random number generator

Odaily reports: According to Bitcoin News monitoring, Coinkite CEO Rodolfo Novak (NVK) stated that a new AI model discovered a Coldcard vulnerability that human reviewers had missed, and Bitcoin developers have raised objections. The vulnerability exists in firmware version 4.0.1 and later, and can bypass the hardware random number generator; between July 30 and August 4, over 5,200 addresses lost approximately 1,816 BTC as a result, worth about $116 million. NVK said there had been at least 15 prior reviews. James O'Beirne stated that he had privately pointed out problems with the Coldcard random number generation in May 2025. A firmware update can fix the issue for new devices, but cannot fix old mnemonic phrases; affected users need to generate new mnemonic phrases.