AI Code Review Missed Critical COLDCARD Vulnerability Exploited Last Week

Coinkite reveals AI models failed to detect the flaw exploited in last week's COLDCARD incident, highlighting risks in automated security audits for Bitcoin hardware.

Woofun AI reports that Coinkite identified the vulnerability exploited in the recent COLDCARD incident as residing at the boundary between two unrelated firmware submodules, rather than within Bitcoin or encryption code. This specific location allowed the flaw to evade both manual and AI-assisted code reviews for years.

Coinkite stated that post-incident testing of advanced AI models, including Kimi K3, Claude Fable, and Codex 5.6, failed to identify the defect. The company now urges security-critical projects to audit build systems and submodule boundaries, warning that AI-assisted development may leave similar blind spots in the Bitcoin ecosystem.