- Published on
Ledger Says Coldcard Exploit Shows Bitcoin Wallet Security Must Adapt to AI
- Authors
- Name
- DeepHorus
Hardware wallet maker Ledger has issued a stark warning to the cryptocurrency industry following the recent Coldcard exploit, calling it a serious reminder that security depends on randomness. Ledger CTO Charles Guillemet said the incident exposed weaknesses in how some devices generate cryptographic randomness. He also emphasized that artificial intelligence is reshaping both cyberattacks and digital defenses.
The warning comes as fallout continues from a vulnerability in Coldcard, a popular air-gapped Bitcoin hardware wallet. Coinkite, the maker of Coldcard, disclosed a flaw that traces back to a March 2021 firmware build. The bug used a software fallback instead of the hardware random number generator to create wallet recovery seeds, making some private keys guessable.
According to Coinkite, losses have reached roughly $130 million, with additional thefts under investigation. On Sunday, Coinkite released patched firmware and urged affected users to move funds to newly generated wallets. Ledger said its own hardware wallets were not affected because they generate recovery phrases differently.
Guillemet explained that Ledger hardware wallets draw their root secret from a true hardware random number generator built into a certified Secure Element, with no software fallback path. He noted that this generator produces the full 256 bits of entropy for every seed. The incident, he said, raises broader questions about how hardware wallet security is evaluated.
"Open source and reviewed are not the same thing," Guillemet said, noting that the Coldcard flaw sat in public code for more than five years until an adversary reportedly used AI to find it. He stressed that being open and being reviewed are two different concepts. This highlights the need for independent security audits.
Guillemet said AI is allowing attackers to scan code, search for configuration errors, and identify vulnerabilities at machine speed. He argued that defense has to move at the same speed, through security by design, hardware, and math. In May, a security researcher using Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash that could have fueled unlimited minting, sending the cryptocurrency down more than 40% in a single day.
Ledger has spent the past two years using AI alongside human security engineers and cryptographers to review code and identify vulnerabilities before attackers can exploit them. The company also maintains the Donjon research lab to try to break its products. Guillemet advised users evaluating any hardware wallet to understand how it generates randomness and whether that process has been independently certified. "Randomness has to come from physics, not a formula," he said.
