AI Attacks on Bitcoin Are Just Getting Started | Rob Hamilton — Key Takeaways
YouTube
AI Attacks on Bitcoin Are Just Getting Started | Rob Hamilton
What Bitcoin Did1h 32mOct 20, 2026
Watch the originalThe Coldcard hack revealed systemic software insecurity — the red team reviewed ~650 codebases, found 10,000+ findings including 1,500 critical/high severity — and exposed that open-weight AI models like Kimi K3 now let a single person do work that previously required expensive audit firms.
Key takeaways
ColdCard hack was entropy from its own seed generation, not an AI-discovered exploit
ColdCard hack was entropy from its own seed generation, not an AI-discovered exploit
- The firmware generated weak entropy internally, creating a systemic single point of failure across all devices simultaneously.
- Users with dice-rolled seeds or strong passphrases were unaffected — only default entropy was compromised.
Software security has fundamentally shifted — AI scanning finds bugs faster and cheaper than human pentesting
Software security has fundamentally shifted — AI scanning finds bugs faster and cheaper than human pentesting
- Hamilton spent $20–25k on scans that would have cost $25–50k and taken weeks via traditional firms — and found more.
- The red team scanned ~650 codebases, surfacing 10,000 findings (1,500 critical/high), including bugs in audited code.
Multisig — not single-key custody — is the baseline for security going forward
Multisig — not single-key custody — is the baseline for security going forward
- Hamilton: single sig with passphrase is a power-user tool; he wouldn't recommend it to family.
- The ColdCard loss was a single vendor/entropy failure; multisig would have neutralized the entire attack.
This Dig holds 4 more insights, 4 flashcards, and 3 quotes — free with your trial.
Unlock this Dig freeStart free with 100 credits · No card, no expiry
In this video
- 1mIntroduction
- 1mThe Coldcard Hack
- 9mBuilding the Bitcoin Red Team
- 17mIs Bitcoin Itself Still Secure?
- 23mAI vs Traditional Security Audits
- 29mThe Cybersecurity Threat Beyond Bitcoin
- 35mWhat “Don’t Trust, Verify” Really Means
- 46mIs Single-Sig Still Safe?
- 55mMiniscript and Time-Locked Recovery
- 58mColdcard’s Failure and Accountability
- 1h 5mWhite-Hat Rescues and Vulnerability Disclosure
- 1h 11mThe Fight Over Open-Source AI
- 1h 18mAI and Freedom of Thought
- 1h 22mCan Governments Ban Open-Source AI?
- 1h 29mWhat’s Next for the Bitcoin Red Team?
“Everything needs to be tested. like your backups aren't actually backups if you don't verify that they're working, right?”
— Rob Hamilton
This page is a partial, transformative summary produced by Homestake. All rights to the original content remain with its creator — please support them at the source link above.
