AI Summary
5 min readIn July 2024, a single open-weight AI model called Kimi K3 triggered a cascade of security crises across the Bitcoin ecosystem, starting with a catastrophic entropy bug in Coldcard hardware wallets that saw over $100 million in Bitcoin swept from hundreds of users in hours. Rob Hamilton, CEO of Anchor Watch, had been using frontier AI models to scan code bases for a year when he realized Kimi K3 could find vulnerabilities the paid, censored models would not touch. What followed was an emergency red team operation that scanned 650 code bases, found 10,000 vulnerabilities (1,500 critical or high), and forced a reckoning with what AI means for Bitcoin security—and for freedom itself.
The Entropy Bug and the Red Team
The attack began when thousands of Bitcoin addresses moved funds to a single address simultaneously. The only explanation was a systemic entropy bug—a failure in how Coldcard generated random seed phrases—not a compromise of individual devices. Hamilton loaded Coldcard's firmware into Kimi K3, spent a dollar, and got the full answer in minutes. Frontier models like Claude and GPT had been blocking such queries, flagging them as cybersecurity risks. Kimi K3 had no such guardrails.
Continue reading the full summary in the app — free to try.
Read Full Summary →Free • No credit card required
Never miss an episode of What Bitcoin Did
Get every new episode summarized in your inbox — free, ~5 minutes to read.
No spam. Unsubscribe anytime.
What you'll learn
- 1 (00:45) **The Cold Card Hack and AI-Enabled Vulnerability Discovery** - Rob Hamilton describes the timeline of the July 2024 Cold Card hack and how he began using AI models to scan code bases.
- 2 (07:01) **Spinning Up the Red Team** - Rob describes how the initial discovery escalated into a massive, volunteer-driven security audit of the Bitcoin ecosystem.
- 3 (11:55) **The Scale of the Problem: 650 Code Bases, 10,000 Findings** - The red team’s scan revealed the extent of vulnerabilities across Bitcoin-adjacent software.
- 4 (17:03) **Bitcoin Core Itself Is Resilient** - The most critical Bitcoin infrastructure survived the AI scrutiny largely intact.
- 5 (20:44) **The State of Bitcoin Software After the Audit** - The ecosystem is in a better place, but the work is never done.
- 6 (21:49) **Why Software Will Always Have Bugs** - A discussion on the fundamental challenge of proving security versus finding vulnerabilities.
- 7 (23:27) **AI Audits vs. Traditional Pen Testing** - Rob compares the efficiency of AI-driven security scanning with traditional human-led audits.
+ Full timestamped outline available in the app
Guests on this episode
Show Notes
"This doesn’t stop, it accelerates from here."
Rob Hamilton returns to discuss the AI attacks on Bitcoin, the fallout from the Coldcard hack and the volunteers racing to find vulnerabilities before hackers do. He explains how the Bitcoin Red Team scanned around 650 codebases, flagging more than 10,000 potential issues, including 1,500 rated high or critical.
We discuss how a $1 AI scan helped Rob identify the Coldcard flaw, what the team found when it tested Bitcoin Core, and how AI is uncovering problems that security audits missed. Rob also explains why he expects the attacks to spread beyond Bitcoin.
We also get into what this means for self-custody, the risks of relying on a single hardware wallet, multisig, testing your backups and whether Bitcoiners really understand the systems protecting their life savings.
Finally, we discuss why some American AI models refused to help with the defensive work, how Chinese open models filled the gap, and why Rob sees attempts to restrict access to AI as a threat to freedom of thought.
THANKS TO OUR SPONSORS:
LEDN - Explore Bitcoin-backed loans and get 0.25% off your first loan.
BITGO - Secure your Bitcoin with institutional grade security.
ANCHORWATCH - Insured Bitcoin custody, security & inheritance. Book a consultation: https://www.anchorwatch.com/wbd
BITKEY - Get 10% off the new Bitkey wallet with code WBD.
EXPAT MONEY - Build your Plan B. Explore second residencies, citizenship and offshore wealth protection.
FOLLOW:
Danny Knowles: https://x.com/_DannyKnowles
Rob Hamilton: https://x.com/Rob1Ham
More from this podcast
What Bitcoin Did →