Community users audited Coldcard code using AI and discovered a critical vulnerability in just 8 minutes

Developers on Reddit used Claude Code to scan the Coldcard open-source firmware for vulnerabilities, identifying the core issue within 8 minutes:

The firmware called a software pseudo-random number generator instead of a hardware true random number generator when generating private keys, and this vulnerability led to the theft of approximately $70 million in BTC from 1,196 wallets.

At the same time, community users also reported that an independent scan using Zhizhu GLM 5.2 (trained on June 16, not connected to the internet) similarly discovered the same vulnerability.

This bug has existed in the open-source wallet code for over five years.