The Coldcard hack increasingly resembles a crypto news item. Except the real story isn’t hidden in the 130 million stolen… It’s hidden in the 15 billion dollars that fled in bitcoin transfers.
In Brief
- 15 billion versus 130 million: for every dollar stolen in the Coldcard hack, a hundred dollars were moved cautiously to safer wallets.
- A 5-year-old vulnerability uncovered by AI: the entropy bug had been dormant in Coldcard’s public code since 2021. It took AI to detect it.
- Defense must now match attack speed: diversifying wallets reduces risk without eliminating it. The real line of defense is speed in auditing your own code.
Bitcoin: 15 Billion Dollars Gone to Safety After the Coldcard Heist
When hackers were cracking Coldcard bitcoin wallets one by one, something else was happening… Something much larger… And in silence. Casa’s CEO, Nick Neuman, revealed a colossal movement of 233,000 BTC, about 15 billion dollars, which left wallets held for over 155 days. This category is watched by analysts as a barometer for serious, patient investors—not ones who panic over a tweet. The funniest part is that some of this volume didn’t even come from Coldcard users.
But Ledger and Trezor holders took advantage of the shock to switch to multisig, fearing they might be next on the list. For every dollar stolen, a hundred dollars were cautiously moved, and Glassnode confirms the magnitude of this movement. Long-term holders’ reserves dropped from nearly 15 million bitcoins to about 14.7 million. The largest weekly decline since December 2024. For Neuman, this proves that distributed self-custody works like an immune system, not a weakness.
AI, the New Enemy of Cold Wallets?
The hacking of Coldcard bitcoin wallets has now gone beyond just a news item. On Bloomberg, Ian Rogers of Ledger explained that AI has changed the very nature of the threat. Not by creating new vulnerabilities. But by giving attackers radically faster discovery tools. Charles Guillemet, CTO of Ledger, goes further: this flaw lay dormant for five years in public code until an attacker used AI to spot it. Five years. Proof that being open source and being truly audited are not the same thing…
A public GitHub repository available since 2021 is useless if no one takes the trouble to truly look into it. An incident now sounding as a warning for all companies developing Bitcoin hardware or software. Sensitive code should urgently be reviewed before malicious AI does it instead. Defense must now operate at the same speed as attack. Which, let’s admit, leaves no real room for naps between audits.
