Anthropic's Claude Flags Coldcard Wallet Weakness in 8 Minutes as Bitcoin Losses Top $100M

Anthropic's AI model Claude reportedly identified the vulnerability exploited in the Coldcard hardware wallet in about eight minutes, underscoring the expanding role of AI in automated security review. Security researcher Medusa said on X that Claude reviewed Coldcard's source code after a single prompt requesting a security assessment and surfaced the same issue used in the ongoing attack, without prior details about the exploit. The finding has been folded into a broader investigation of a Coldcard compromise that the crypto community now estimates has resulted in more than $100 million in stolen Bitcoin. Researchers tied the flaw to weaknesses in Coldcard's cryptographic random number generation. Hardware wallets rely on high-quality, unpredictable randomness to generate private keys and create digital signatures. If that randomness is flawed, attackers may be able to reconstruct secrets and gain unauthorized access, potentially leading to large losses. Investigators also warned the campaign may still be active. Alex Thorn, Galaxy's head of research, wrote on X that Bitcoin blocks 960,778 through 960,792 included 218 suspicious transactions spanning 462 wallet addresses. Those transactions reportedly moved nearly 389 BTC in what he described as another coordinated wave. Thorn urged Coldcard users to move any remaining funds off potentially affected devices immediately. He also recommended using higher transaction fees to improve confirmation priority before attackers can disrupt pending transfers. The episode has renewed debate over whether AI tools can help security teams spot critical vulnerabilities before they are exploited. BlockTower Capital founder Ari Paul previously argued that the Coldcard incident points to an industry-wide fragility around cryptographic randomness rather than a failure confined to a single wallet maker. Developers and researchers continue to monitor on-chain activity while remediation efforts focus on the randomness-related weakness linked to losses estimated above $100 million.