Community users used AI to audit Coldcard code, discovering a critical vulnerability in just 8 minutes

TechFlow News, August 2: A developer on Reddit used Claude Code to scan Coldcard open-source firmware for vulnerabilities, locating the core issue within 8 minutes:

When generating private keys, the firmware called a software pseudo-random number generator instead of a hardware true random number generator, and it was this vulnerability that led to the theft of approximately $70 million worth of BTC from 1,196 wallets.

Meanwhile, community users also reported that independently scanning with Zhipu GLM 5.2 (trained on June 16, offline) similarly discovered this vulnerability.

This bug has existed in the open-source wallet code for over five years.