Hardware wallet maker Ledger is calling the Coldcard exploit a critical warning for the cryptocurrency industry, with Chief Technology Officer Charles Guillemet saying the incident exposes fundamental weaknesses in how Bitcoin wallets generate cryptographic randomness and underscores how artificial intelligence is reshaping the threat landscape.
What Went Wrong at Coldcard
Last week, Coinkite, the maker of the Coldcard Bitcoin hardware wallet, disclosed a firmware flaw tracing back to a March 2021 build. The bug caused the device to rely on a software fallback instead of its dedicated hardware random number generator when creating wallet recovery seeds. That made some private keys guessable, allowing thieves to drain user Bitcoin holdings.
Losses from the exploit have climbed to roughly $130 million, with additional thefts still under investigation. On Sunday, Coinkite released patched firmware and urged affected users to transfer funds to newly generated wallets. Coinkite did not respond to a request for comment.
Ledger Says Its Architecture Was Not Affected
Guillemet said Ledger devices draw their root secrets, the 24-word Secret Recovery Phrase, from a true hardware random number generator embedded directly in a certified Secure Element, with no software fallback path. That generator, he said, produces the full 256 bits of entropy for every seed.
‘We are treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness,’ Guillemet said. ‘Cryptography is hard and implementing it securely is harder. This week’s Coldcard incident made that visible in the most expensive way possible.’
Ledger competes directly with Coldcard in the hardware wallet market, and the architectural distinction Guillemet draws is one Ledger markets on. The technical point stands on its own, and it is being made by a rival.
Open Source Is Not the Same as Reviewed
Guillemet drew a sharp distinction between code that is publicly visible and code that has actually been audited.
‘Open source and reviewed are not the same thing,’ he said. ‘This flaw sat in public code for more than five years until, reportedly, an adversary used AI to find it, a reminder that being open and being reviewed are two different things.’
AI Is Accelerating Both Attacks and Defenses
The Ledger CTO said AI tools now allow attackers to scan codebases, search for configuration errors, and identify vulnerabilities at machine speed, compressing the time between a flaw’s existence and its exploitation.
‘That means defense has to move at the same speed,’ he said. ‘It needs to come from security by design, hardware, and math.’
The dynamic is not hypothetical. In May, a security researcher using Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash that could have enabled unlimited token minting. That disclosure triggered large-scale investor panic and sent Zcash down more than 40% in a single day.
Guillemet said Ledger has spent the past two years deploying AI alongside human security engineers and cryptographers to review its own code and surface vulnerabilities before attackers can reach them. ‘We also don’t just rely on our own word for it,’ he said. ‘Our Donjon research lab exists to try to break our products before anyone else can.’
What Users Should Demand
Guillemet offered a clear checklist for anyone evaluating a hardware wallet: understand how the device generates randomness and verify that the process has been independently certified, not simply asserted by the vendor.
‘Randomness has to come from physics, not a formula,’ he said. ‘It has to be certified by people whose job is trying to break that claim, not just asserted by the vendor.’
