How AI Is Reshaping Crypto Security, with Michael Coates

How AI Is Reshaping Crypto Security

The summer of 2026 saw a shocking breach that rattled the entire crypto community: attackers drained $116 million from more than 5,200 Coldcard hardware wallets without ever touching a single device. The culprit was a subtle software change that swapped a hardware random‑number generator for a pseudo‑random one, collapsing seed‑phrase entropy from 128 bits to about 40. The flaw sat in the code for over four years before the drain exposed it, making the Coldcard hack the largest hardware‑wallet exploit on record.

1. What the Coldcard Hack Reveals About Audits

Coldcard’s seed phrase is the keystone of its security. A March 2021 code change replaced the secure hardware RNG with a software pseudo‑random generator. Audits at the time only verified that a check ran, not that the source was secure. The result: a seed entropy of roughly 40 bits, easily brute‑forced offline. Even meticulous developers can slip up, and a single reviewer may miss the same mistake. Coates’ rule of thumb is to weigh the pedigree of the manufacturer: a small, well‑meaning team can miss what a larger, budget‑rich organization would catch. AI can now turn a subtle bug into a quick find for both attackers and auditors, shrinking the window between discovery and exploitation.

2. Securing a Wallet Beyond “Not Your Keys, Not Your Crypto”

Self‑custody is only safe if you truly understand what you’re doing. Coates stresses that no single point of failure should exist. Multi‑sig schemes—requiring two of three or three of five keys—spread risk across different hardware and people. A trusted broker or a geographically dispersed safe deposit box can serve as the third signer. For everyday spending, a single‑signer wallet remains fine, but the hardware in front of you must still be protected with up‑to‑date antivirus and OS patches. The goal is to remove the user from the attack surface, just as a YubiKey refuses to sign a transaction for a phishing site.

3. AI Shifts Security to Computer Scale

Defenders are racing to keep pace with open‑source models that are rapidly improving at offense. Each month a new model becomes available for attackers, while defenders lag behind. Deepfakes and AI‑generated phishing calls are already a reality; a finance employee could be tricked into wiring millions to an AI‑controlled CFO. The solution is to automate defenses: hardware that only responds to legitimate sites, real‑time threat detection, and automated incident response. Coates compares this to the 25‑year‑old Code Red worm, but now the adversary is a self‑organizing agent that can move through systems autonomously.

4. Nation‑State Threats and Solana’s STRIDE Response

Coates has testified before Congress and the Department of Homeland Security about the escalating threat from state‑backed AI campaigns. He cites the 2025 Anthropic‑Claude operation that targeted dozens of entities. The response is to build automation before it’s needed. At Twitter, anything that took two seconds was too slow; the team learned to make security outcomes happen in real time. Solana’s STRIDE program—continuous security rating for DeFi protocols—alongside circuit‑breaker code that trips on its own, exemplifies this shift to computer‑scale defense.

Takeaway

AI is both the weapon and the shield in crypto security. The Coldcard hack shows how a single oversight can collapse an entire ecosystem. The future lies in layered, automated defenses that eliminate human error and keep pace with machine‑driven threats.

TL;DR

AI‑driven attacks exposed a four‑year‑old flaw in Coldcard wallets, proving that even small teams can miss critical bugs; the solution is layered, automated defenses and multi‑sig strategies to keep pace with computer‑scale threats.