Coldcard flaw tied to estimated $130M losses; Ledger urges AI-powered security rethink for hardware wallets

Ledger says a newly disclosed vulnerability affecting Coinkite's Coldcard hardware wallet should prompt the Bitcoin hardware wallet industry to reassess its security assumptions. Ledger CTO Charles Guillemet said Ledger devices are not impacted because recovery phrases are generated inside a certified secure element that includes a hardware random number generator. Coinkite disclosed last week that its air-gapped Coldcard Bitcoin hardware wallet contains a vulnerability tracing back to firmware versions from March 2021. The issue involves using a software rollback mechanism in the process of generating wallet recovery seeds, enabling certain private keys to be guessed and leading to estimated losses of about $130 million. Coinkite released patched firmware on Sunday and advised affected users to move funds to newly generated wallets. Guillemet warned that "open source" does not mean "reviewed," noting the weakness remained in publicly accessible code for more than five years. He added that AI is accelerating attacks by allowing adversaries to scan code and identify vulnerabilities at machine speed. He said Ledger has spent the past two years combining AI tools with security engineers and cryptography specialists to review code and detect flaws. Guillemet added that consumers comparing hardware wallets should pay close attention to how randomness is produced and whether the process has been independently certified.