We understand there is real anger at this moment. Users have suffered real losses, and for those impacted, no public statement is enough.

We continue to support affected customers directly and urge others to reach out to any other users they are aware of who may be affected. Urgently: if your seed was generated with our affected firmware, without at least 50 independent, private dice rolls, and your funds aren’t protected by a strong, unique BIP-39 passphrase, move those funds to a new wallet now.

We also believe this vulnerability is a warning for every company building Bitcoin hardware and software, not only us—and we’re publishing this now, while the details are still fresh, because other companies need time to check their own code to prevent potential further loss.

To support that effort, we’ve published a new resource: coinkite.com/historical-disclosures, a page that records all known public security research, coordinated disclosures, professional reviews, internal findings, and security advisories affecting COLDCARD devices.

We’re publishing it because researchers, journalists, and security teams doing their own review need a definitive record to work from. We’ll keep this updated as the investigation continues.

Where This Bug Lived

As independent researchers have publicly corroborated, this firmware bug appears to have lived at a boundary between two unrelated submodules, not in the parent code, and not in the cryptographic or Bitcoin-specific logic that are the subject of most internal and third-party reviews.

Because the flag check looked correct, the bug silently went unnoticed, and its potential impact grew with every release.

We believe it’s important for the broader ecosystem to understand how this bug arose, and why it evaded detection, so they can avoid similar consequences.

What AI-Assisted Review Did, and Didn’t, Catch

We know there are questions about our own use of AI in code review. We’ll cover this fully in our post-mortem, but given the active investigation right now, here’s what we can say immediately.

We’ve run AI-assisted review against our critical codebases, including in the weeks before the exploit. It did not catch this vulnerability. Since the incident, we’ve also tested our code against frontier models, including Kimi K3, Claude Fable, and Codex 5.6. None of them caught it.

It’s a reason for us, and anyone else relying on AI tools, to be specific about what they currently catch and what they might not.

What We’re Asking Other Teams to Do

We remain committed to sharing what we learn as our own review process continues. If your team relies on AI review of security-critical code, we recommend you test it specifically against build and submodule boundaries.

As a result of these new and powerful AI models, we believe many Bitcoin projects, including those that rely on open-source code, require immediate review.

We’re addressing what we can, we’re supporting the people directly affected, and publishing everything we know.