{"schema_version":"0.10.0","id":"LR-2026-0710","record_version":1,"title":"AI reportedly collapses exploit window in crypto wallet hack","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":4.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"ef2bf204c5404ae3468c6984a13bd8c2a28a5556128c29700166654d5eb5240d"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-03","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Coinkite’s Coldcard hardware wallet generates the recovery seed that controls users’ Bitcoin, and those seeds were meant to be kept offline. The sources say the wallet’s seed generation was routed during a 2021 software migration away from the intended hardware random-number generator toward a software fallback in a MicroPython component, reducing randomness. On Thursday, July 30, nearly $89 million disappeared from thousands of addresses associated with wallet holders who kept keys offline. The theft did not require breaking Bitcoin’s underlying cryptography or remotely penetrating an air-gapped device. Coinkite said that because its source code was public, it was assuming someone used frontier AI to review older firmware and uncover the issue. The sources do not describe how the theft was detected or what Coinkite changed afterwards.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test met: funds of others were touched and the scope is stated as thousands of addresses.","harm_class":["financial"],"affected_description":"thousands of addresses associated with Bitcoin’s most security-conscious asset holders","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.pymnts.com/cybersecurity/2026/ai-collapses-exploit-window-crypto-wallet-hack/","publisher":"PYMNTS.com","date":"2026-08-03","type":"press","title":"AI Collapses Exploit Window in Crypto Wallet Hack - PYMNTS.com","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Instead, attackers appear to have identified and exploited a software defect using artificial intelligence that weakened the randomness used to generate Coldcard wallet seeds, reducing the number of possible private keys enough to make them searchable offline."}],"event.adversarial_actor":[{"source_index":0,"quote":"Instead, attackers appear to have identified and exploited a software defect using artificial intelligence that weakened the randomness used to generate Coldcard wallet seeds, reducing the number of possible private keys enough to make them searchable offline."}],"impact.harm_class":[{"source_index":0,"quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders."}],"impact.affected_description":[{"source_index":0,"quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders."}],"impact.severity":[{"source_index":0,"quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders."}],"impact.severity_because":[{"source_index":0,"quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders."}],"event.summary":[{"source_index":0,"quote":"Coinkite said the problem originated in a 2021 software migration."},{"source_index":0,"quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders."},{"source_index":0,"quote":"The theft did not require breaking Bitcoin’s underlying cryptography or remotely penetrating an air-gapped device."},{"source_index":0,"quote":"Coinkite, the company behind the Coldcard wallet, said Thursday that because the Coldcard source code was publicly available, the company is assuming someone used frontier AI to review older firmware and uncover the issue."}]},"notes_on_gaps":"The affected system is a Bitcoin hardware wallet, not an AI system; no model, harness, tools, autonomy or guardrail fields are stated. The AI role is Coinkite's assumption about an attacker, not a confirmed fact, so no agent_involved or failure_class is recorded. The loss figure is given only as nearly $89 million, so no exact direct_loss_usd is recorded. Date of disclosure and date of detection are not stated; the article date of 2026-08-03 is publication, not disclosure, so it is not used. Detection method, trigger, country, containment, remediation and any Coinkite fix are not stated. The OpenAI and Hugging Face items concern another incident and are excluded. Severity moderate is my judgement from the stated bounded scope of thousands of addresses. No controls were reported as held, failed or missing in this incident, so links is empty. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A seed-generation flaw weakened randomness, making private keys searchable offline.","quote":"Instead, attackers appear to have identified and exploited a software defect using artificial intelligence that weakened the randomness used to generate Coldcard wallet seeds, reducing the number of possible private keys enough to make them searchable offline.","source_index":0,"grade":"C"},{"step":"reached","text":"Funds disappeared from thousands of addresses on July 30.","quote":"On Thursday (July 30), however, nearly $89 million disappeared from thousands of addresses associated with Bitcoin’s most security-conscious asset holders.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.pymnts.com/cybersecurity/2026/ai-collapses-exploit-window-crypto-wallet-hack/"]},"analysis":{"sections":{"timeline":[{"text":"The flaw originated in a 2021 software migration.","quote":"Coinkite said the problem originated in a 2021 software migration.","source_index":0,"when":"2021"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.pymnts.com/cybersecurity/2026/ai-collapses-exploit-window-crypto-wallet-hack/"]}}