Bitcoin’s biggest near-term security problem may not be a breakthrough against its cryptography, but the software and hardware already standing between a private key and its owner. As AI gets better at finding seams in that custody stack, even cold storage deserves a closer look.
Bitcoin cold storage shuts one door. The rest of Bitcoin custody still hums with code, chips and human choices. The private key stays off an always-connected device; the machinery around it stays in play.
Coinkite showed how in its July 30 technical disclosure, published in 2026. A 2021 integration change sent wallet seed generation down a MicroPython software fallback instead of the intended hardware random-number path. Later affected models still mixed some secure-element entropy. Coinkite called its numerical estimates preliminary. Bitcoin kept working as designed; the key factory stumbled.
New firmware protects future generation. Seeds created under affected software carry their history. Coinkite tells users to replace those seeds and migrate funds, except when the original independent-dice-entropy condition applies.
Coinkite also floated AI as a possible route to discovery. The disclosure labels that idea an assumption and notes that its own AI-assisted review missed the bug. Smarter agents raise a broader risk across the custody stack, where code paths, build systems and devices offer seams to probe.
Cold storage inherits a supply chain
Before a seed phrase becomes words, it is entropy. BIP-39 starts with computer-generated entropy, adds a deterministic checksum and maps the result to words. The checksum can flag some invalid mnemonics; all randomness still comes from the original entropy. A weak start echoes through every word.
Reproducible-build procedures answer whether a distributed binary matches published source after signatures and headers are accounted for. Source correctness lives one level deeper. COLDCARD’s disclosed integration bug sat at that level, ready to appear faithfully in a matching build.
A wallet can receive a bad instruction before it signs. On December 14, 2023, malicious releases of Ledger’s dynamically loaded Connect Kit library induced users to sign draining transactions. Ledger reported that its infrastructure, code repositories and integrated decentralized applications remained untouched. Hostile transaction software still reached the approval step before a hardware wallet could sign.
The trust moves through six layers.
| Custody layer | Trust that remains | Observed boundary |
|---|---|---|
| Seed generation | The entropy implementation must behave as intended. | COLDCARD sent generation down the wrong randomness path; Bitcoin kept operating normally. |
| Firmware and builds | Published source, build output and security logic must all be sound. | Reproducibility exposes source-to-binary drift. A source-level bug can survive into a matching binary. |
| Transaction construction | Surrounding software must present the transaction the user intends to authorize. | Malicious Connect Kit releases reached users through a dynamically loaded library. |
| Signing | The signer must produce output that is both valid and honest. | Dark Skippy demonstrates seed exfiltration through valid signatures from an air-gapped device. |
| Hardware | Chip protections and firmware state logic must work together correctly. | Ledger Donjon bypassed a Tangem recovery-state check with a costly specialist physical attack. |
| Recovery | Any opted-in backup providers, identity checks and restoration flows must work as designed. | Ledger Recover adds operational parties through an optional paid service. |
Each case depends on a particular defect, compromise or shared dependency. Cold storage is an architecture assembled from those boundaries.
A valid signature can carry a secret
An air gap closes the network door. A signed transaction still has to leave, creating a mail slot that malicious firmware can misuse.
The Dark Skippy researchers demonstrated a method that can encode seed material into two valid Bitcoin transaction signatures. Those signatures travel through the normal transaction path. Bitcoin accepts them while seed material rides inside. In August 2024, the researchers reported zero known cases in the wild and warned that covert use could be hard to spot.
A related USENIX WOOT 2024 project built an end-to-end backdoored wallet on Bitcoin testnet and leaked a 256-bit seed in 10 valid ECDSA signatures. Each project used a different technique and signature count. Both reveal the same danger: a transaction can satisfy Bitcoin’s rules while the device creating it acts against its owner.
Risk also lives below the signer. In research published July 9, 2026, Ledger Donjon used laser fault injection to bypass a faulty recovery-state check in Tangem firmware, undermining the boundary of an EAL6+-certified secure element. The demonstration required physical possession, advanced expertise, extensive characterization and roughly $250,000 in laboratory equipment.
This was specialist lab work. It also showed that chip certification and firmware logic protect the same boundary; strength in one layer leaves errors in the other exposed.
Recovery adds chosen dependencies. For subscribers who opt in, Ledger Recover distributes encrypted seed shares among backup providers. Identity checks, operational handling and restoration on a new device join the custody chain. Only subscribers who opt in assume those added parties.
Key isolation is one part of cold storage. Failure recovery is another. COLDCARD makes the distinction concrete. Closing a generation bug in firmware leaves existing affected key material in place, so users may need to replace the seed and migrate funds.
AI is learning to hunt the seams
The custody stack gives advanced agents several seams to test around a Bitcoin key.
On July 21, 2026, OpenAI disclosed that models with reduced cyber refusals were running an internal benchmark built to test advanced exploitation. According to OpenAI, they found and chained vulnerabilities across its research environment and Hugging Face’s production infrastructure. The benchmark set a general exploitation goal, and the models reached Hugging Face while pursuing it. OpenAI calls the account preliminary, with its investigation and third-party assessment continuing.
Five days earlier, Hugging Face’s July 16, 2026, disclosure documented the production compromise and continuing impact assessment. Its initial account left the model identity unknown. OpenAI supplied that attribution later. The demonstrated target was software infrastructure. Bitcoin wallets, key recovery and cryptographic primitives sat outside the episode.
Closer to crypto, work published June 17, 2026, describes Cerberus as a human-in-the-loop agent team that produced implementation-security findings in wallet and payment software. Its scope was software review, separate from autonomous seed recovery and the COLDCARD disclosure.
Specific future zero-days remain unknowable. Current evidence points to a change in tempo. Stronger AI pentesting may find defects sooner and connect separate weaknesses across the path from seed generation to recovery.
Cold storage cuts exposure. Its strength comes from knowing where trust sits and having a way out when a layer fails.
AI may shrink the time between a coding mistake and its discovery. The pressure lands on human-built custody machinery. Bitcoin’s cryptographic core remains intact.
