AI Risk Wire

Cases › security breach › LR-2026-0710

AI reportedly collapses exploit window in crypto wallet hack

Preliminary Why: Publisher not yet named · subject to change

Status: no action reported

Severity moderate
Reported 3 Aug 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: test met: funds of others were touched and the scope is stated as thousands of addresses.

Coinkite’s Coldcard hardware wallet generates the recovery seed that controls users’ Bitcoin, and those seeds were meant to be kept offline. The sources say the wallet’s seed generation was routed during a 2021 software migration away from the intended hardware random-number generator toward a software fallback in a MicroPython component, reducing randomness. On Thursday, July 30, nearly $89 million disappeared from thousands of addresses associated with wallet holders who kept keys offline. The theft did not require breaking Bitcoin’s underlying cryptography or remotely penetrating an air-gapped device. Coinkite said that because its source code was public, it was assuming someone used frontier AI to review older firmware and uncover the issue. The sources do not describe how the theft was detected or what Coinkite changed afterwards.

What happened

1 · What went wrongA seed-generation flaw weakened randomness, making private keys searchable offline.
2 · What it reached or didFunds disappeared from thousands of addresses on July 30.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

  1. 2021 The flaw originated in a 2021 software migration.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-08-03
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
money
C one secondary source states it
Who was affected
thousands of addresses associated with Bitcoin’s most security-conscious asset holders
C one secondary source states it
Why this severity
test met: funds of others were touched and the scope is stated as thousands of addresses.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The OpenAI and Hugging Face items concern another incident and are excluded.

LR-2026-0710 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON