How a hidden flaw in Coldcard wallets led to an $88.6m Bitcoin theft

The elliptic-curve mathematics underneath Bitcoin has never been broken. The randomness feeding it was.

The blast radius is also wider than the coins that moved. A seed is not a Bitcoin object; it is simply entropy. It can also generate addresses and keys for other systems. Anyone who took a Coldcard seed into a multi-chain wallet was using the same broken dice at a different table.

Coinkite, the Canadian firm behind the device, has published its own account of what went wrong. A few weeks before the theft, the company ran one of the best available AI models over this exact code, looking for security problems. The review came back clean. The company also believes that is how the attacker found the flaw, the firmware having always been open source. Both sides had the same tool. It worked for only one of them.

The episode highlights an important problem with AI-assisted security. A defender asks a model to review a codebase and needs it to spot every serious vulnerability. An attacker asks it to find one exploitable path and can afford any number of wrong answers because he needs only a single correct one. Defence has to be right everywhere. Offence has to be right once. Cheap code review does not soften that asymmetry – it accelerates it.

The asymmetry of defence

Which brings us to the mantra. Not your keys, not your coins. The oldest line in Bitcoin. It was aimed at exchanges, and last week it delivered exactly as written. The victims held their own keys. So did the attacker. The protocol has no view on which of them was the owner.

That is why recovery here is worse than difficult. Bitcoin is a bearer instrument. Whoever can produce a valid signature can move the coin. The network does not ask whether you are entitled to the funds. It asks only whether the signature is correct.

After that, the argument moves to the courts. You have to find the person, in a jurisdiction willing to hear you, then prove the wallet was yours and that the transfer was theft rather than authorised. From the chain alone, those stories can look the same.

Who would you sue?

Some years ago, a Bitcoin whale came into the office to hear about the digital asset products we were running. He asked about custody inside 90 seconds, then made a performance of not trusting a single name on the list. Enterprise-grade, ISO-certified, audited, insured – and, to him, beside the point, because somebody else held the keys.

My answer then is the one I would give today. A regulated custodian is the part of the structure that can be made to pay. If client assets are mishandled, there may be insurance, contractual liability, auditors and regulators to pursue. None guarantees recovery, but somebody is on the hook.

He chose otherwise, as was his right. The trouble is that the choice was made by slogan. Six words settled a question about a very large sum of money that deserved a conversation about failure modes, insurance and precisely who you would sue.

None of this is an argument for buying the ETF and switching your brain off. Self-custody did not fail here. One vendor's build pipeline failed, and every user who supplied his own dice rolls at set-up came through untouched. But the defect was invisible for five years, and it lived inside the exact ritual the practice tells you is the safe one.

No way to check

Which leaves the unpleasant part. There is no self-test. You cannot run anything against your own wallet to learn whether your seed fell inside the reproducible set, because a compromised seed and a sound one look identical. The only honest posture is to assume you are in it, and move the assets to a newly generated, secure wallet.

The lesson is not that self-custody does not work. It is that it transfers responsibility. The important question is not simply who holds your keys, but who bears the loss when those keys fail.

Yevgeny Bebnev is an investment professional and multi-manager fund specialist based in Dubai. He is also the founder and CIO of Alaris Capital