Coinkite, the Canadian company behind the Coldcard hardware wallet, has released new firmware weeks after disclosing the flaw that let attackers drain more than $114 million from bitcoin holders.
The company said the review behind it was AI-assisted, naming Kimi and other frontier models among the tools used to examine not just the faulty randomness code but the whole system.
That review found problems unrelated to the original bug in the way transactions are approved, how data is handled over USB and how firmware updates are validated.
Installing the update does not make an existing compromised wallet safe. Anyone whose seed, or the master key that controls a wallet's coins, was created on affected firmware between 2021 and July 2026 still has to generate a new one and move their money across.
New seeds now work differently. Every one requires the owner to supply the randomness by hand, either 65 key presses at unpredictable intervals, 50 rolls of a six-sided die, or 128 coin flips. Physical randomness is used because a die or a coin produces results no software can predict, while the flaw that caused the theft was in the device generating randomness by itself, as CoinDesk previously explained.
Underneath, Coinkite replaced the backup random number generator entirely, swapping an algorithm called Yasmarang for one built on SHA-256, the hashing function bitcoin itself uses.
The device now re-checks a transaction immediately before signing it, so a computer compromised at the USB port cannot alter a payment after the owner has approved it on screen. sSgnature modes that leave parts of a transaction editable after signing are now blocked by default.
Law enforcement is still investigating the thefts and working to identify those responsible, the company said, and it remains available to assist.
Coinkite is asking owners of its Mk4 and Mk5 devices to install version 5.6.1, and owners of the newer Q model to install 1.5.1Q, from its official downloads page only. It has also launched a public status page listing which releases are fixed and what migration steps apply.
How AI is helping catch bugs #
Coldcard is the fifth bitcoin or crypto outfit in three weeks to say publicly that AI has changed how security work gets done.
BTCPay Server, free software merchants run themselves to accept bitcoin payments, was hit this month when attackers drained Lightning nodes belonging to its users through a flaw it had just patched. The project is offering a bounty of up to 3 $BTC for the return of the money and has paid 0.42 $BTC to the researchers who found the flaw, while telling merchants to keep funds in cold storage and move excess out of hot wallets regularly, "especially during this period of rapid, AI-driven change."