AI Code Reviews Fail to Detect Bitcoin Hardware Vulnerability

Coinkite reveals AI tools missed a critical Coldcard flaw, urging immediate audits for Bitcoin hardware and software projects relying on automated security checks.

Woofun AI reports that Coinkite, the manufacturer behind Coldcard, disclosed that AI-assisted code reviews failed to identify a security vulnerability exploited by hackers. The firm stated that despite conducting reviews weeks prior to the exploit, advanced models including Kimi K3, Claude Fable, and Codex 5.6 did not detect the issue post-incident.

Coinkite emphasized that the flaw resided in the interaction between two firmware components, rather than in parent code or encryption logic typically scrutinized by audits. The company warned that teams relying on AI for security-critical code must perform specific tests on build boundaries and submodules, calling for immediate audits across many Bitcoin projects dependent on open-source code.