Dragonfly's Qureshi: $2 AI Audit Could Have Caught Coldcard Bug

The Coldcard vulnerability could have been caught by an artificial intelligence audit that cost roughly $2, Dragonfly managing partner Haseeb Qureshi said. He warned that cybersecurity is becoming a spending race as the price of finding flaws collapses.

Coldcard, a hardware wallet for bitcoin made by Coinkite, disclosed an entropy flaw affecting seeds created with certain firmware versions. The bug caused some devices to rely on a software-based random number generator instead of the intended hardware source of randomness. Coinkite released emergency updates on July 31 and told affected users to create new seeds and move their funds. Installing new firmware alone does not repair an old seed.

One test using Anthropic's Claude Code reportedly found the vulnerability in about eight minutes. Qureshi cautioned that the result may have been influenced by internet access, which could have exposed the model to existing information about the bug. A second test used a model called GLM 5.2 with web access disabled. It reproduced the flaw in roughly 20 minutes. Based on the model's input and output costs, Qureshi estimated the audit cost about $2.