Dragonfly’s Haseeb Qureshi Says $2 AI Audit Could Have Caught Coldcard Flaw

Coldcard Flaw Could Push Crypto Firms to Test Every Release With AI

Artificial quality is making vulnerability find truthful inexpensive that information whitethorn progressively beryllium connected however overmuch companies are consenting to walk earlier attackers do.

That is the informing from Dragonfly managing spouse Haseeb Qureshi aft AI models reportedly rediscovered a captious weakness successful Coldcard’s bitcoin wallet firmware wrong minutes.

“Cybersecurity is present each astir spend,” Qureshi wrote connected X. The cardinal question, helium said, is however overmuch developers put successful AI-based investigating compared with imaginable attackers.

Source: @Hosseeb connected X

Coldcard disclosed an entropy flaw affecting seeds created with definite firmware versions. The bug caused immoderate devices to trust connected a deterministic bundle generator alternatively of the intended hardware root of randomness. Coinkite released exigency updates connected July 31 and told affected users to make caller seeds and determination their funds. Installing caller firmware unsocial does not repair an aged seed.

Vulnerability Was Reportedly Found Within Minutes

One trial reportedly recovered the flaw with Anthropic’s Claude Code aft astir 8 minutes. Qureshi cautioned that the effect whitethorn person been influenced by net access, which could person exposed the exemplary to existing accusation astir the bug. A separate test disabled web entree and utilized GLM 5.2. It reproduced the vulnerability successful astir 20 minutes.

Source: Medusa Onchain connected X

Based connected the model’s input and output costs, helium estimated that the audit outgo astir $2. “$2 of AI hardening would’ve caught this bug. There is nary excuse for this,” helium remarked. Qureshi projected a caller measurement called Cost of Discovery, oregon CoD. The metric would estimation however overmuch it costs a frontier AI exemplary to independently reproduce a vulnerability.

Smaller Security Vendors Face Growing Pressure

The occurrence whitethorn person wider consequences for the hardware wallet market.

Qureshi argued that larger vendors volition person an vantage due to the fact that they tin walk much connected automated testing, audits, and merchandise hardening. Smaller companies whitethorn conflict to lucifer attackers who tin scan codification continuously astatine small cost.

Startups gathering wallets, astute contracts oregon different products that support wealth should tally AI information reviews earlier each release, helium recommended.

Qureshi besides challenged a communal presumption astir open-source security. Public codification tin support users from malicious developers, helium said, but it does not automatically support them from attackers.

AI tin service some sides. It lowers the terms of uncovering vulnerabilities, but it besides gives developers stronger antiaircraft tools.

“We person nary prime but to adapt,” Qureshi said.