AI Audits Found a Four-Year Zcash Bug and Drained $100M in Bitcoin

AI-assisted auditing is finding what years of specialist review missed. Attackers are running the same playbook first.

Key takeaways

• Researcher Taylor Hornby used Claude Opus 4.8 to find a four-year-old counterfeiting flaw in Zcash's Orchard shielded pool in a single day; an emergency hard fork followed within days.
• A firmware entropy bug in Coldcard devices, present since March 2021, preceded more than $100 million in bitcoin theft from thousands of single-sig wallets beginning July 30, 2026; Coinkite said it had to assume an attacker used AI to inspect its public firmware.
• Malicious on-chain dead drops carrying malware instructions jumped 440%, from roughly 2.06 per day to 11.1 per day, with state-linked actors tied to North Korea and Iran accounting for roughly two-thirds of new activity by Q2 2026.

On May 29, 2026, one day after Anthropic released Claude Opus 4.8, independent security researcher Taylor Hornby used that model inside a custom audit agent to find a critical soundness vulnerability in Zcash's Orchard shielded-pool circuit that had been present since Orchard's launch in May 2022. Two months later, a five-year entropy failure in Coldcard firmware preceded the largest hardware wallet exploit on record, draining more than $100 million in bitcoin from thousands of addresses across a matter of hours. AI is now on both sides of every audit.

A Four-Year Zcash Flaw, Found in One Day

Hornby's agent uncovered a missing constraint in the halo2_gadgets elliptic-curve check. The flaw allowed mathematically invalid inputs to pass verification inside the Orchard pool, enabling unlimited counterfeit ZEC to be generated in a local test environment. He disclosed privately to Zcash's coordinating development body the same evening. An emergency fix deployed in early June 2026, followed by an emergency hard fork.

Shielded Labs stated the vulnerability was present from Orchard's activation in May 2022 until the fix was deployed, and added: "Because Orchard is a privacy pool, there is no way to cryptographically determine whether this vulnerability was exploited between May 2022 and June 2026." ZEC's price dropped sharply on disclosure. Shielded Labs said exploitation before the patch appears unlikely, though it cannot rule it out with certainty. That uncertainty, by design, cannot be resolved.

The Zcash incident is the cleaner of the two stories. Responsible disclosure, rapid patch, hard fork. The bug survived roughly four years of specialist review before an AI agent found it in a single session.

The Coldcard Incident Hits Bitcoiners Directly

The Coldcard breach is the one that matters most to this audience, and it is considerably messier. A build configuration error in firmware version 4.0.1, released March 2021, set a macro that caused seed generation to fall back to a deterministic software PRNG rather than the STM32 hardware RNG. Effective entropy dropped from 128 bits to as low as approximately 40 bits on some Mk3 devices. The bug sat there for five years.

Sweeps began July 30, 2026. The first wave drained roughly 1,082 BTC from approximately 1,196 addresses in 41 minutes. TRM Labs estimated total losses at approximately 1,816 BTC, around $116 million, across more than 4,500 addresses. Coinkite shipped emergency firmware July 31 and stated it had to assume somebody used AI to inspect its public firmware. Attribution is not settled. The vulnerability itself is not in dispute.

The practical implication is unambiguous. Every single-sig wallet generated on affected Coldcard firmware between March 2021 and the patch window should be treated as compromised and migrated immediately to a new seed on patched firmware. BIP-39 passphrase users and anyone who used dice-rolled entropy are unaffected. Everyone else needs to act now, regardless of whether they have seen any suspicious activity. The Wave 3 attacker was still moving stolen funds as recently as this month.

Bitcoin Core's conservative, multi-audit development process starts to look less like bureaucratic friction and more like the reason Bitcoin's base layer is not in this report. The question is whether the tooling around Bitcoin, hardware wallets, signing devices, node software, is held to the same standard. The Coldcard answer, as of July 30, 2026, is that it was not.

The AI agent security surface is not limited to wallets, either. On May 4, an attacker posted Morse-code text that Grok decoded into an instruction Bankrbot accepted, triggering the transfer of roughly 3 billion DRB tokens worth approximately $150,000 to $200,000 to an attacker-controlled address. Bankrbot confirmed on X: "Grok got hit with a prompt injection." SlowMist labeled it a permission chain attack. The attacker did not crack cryptography. The machines trusted each other too much.

The Threat Surface Is Scaling

The macro signal underneath these incidents comes from Chainalysis. Malicious on-chain writes, blockchain dead drops carrying malware instructions and command-and-control data, climbed from roughly 2.06 per day to 11.1 per day, a 440% increase. Chainalysis associates the surge with the mid-2025 release of open-weight AI models lacking safeguards. Eric Jardine, Chainalysis's cybercrimes research lead, described a clear point-in-time association between open-weight model releases and the dead-drop spike while noting that direct attribution to specific models is not provable.

State-linked actors tied to North Korea's UNC5342 and Iran-linked groups accounted for roughly two-thirds of newly observed dead-drop activity by Q2 2026. Chainalysis tracked this across five major blockchains, more than 15 distinct campaigns, and more than a dozen malware strains. Separately, Chainalysis linked roughly $36.7 million in thefts to attacks on protocols with unverified contracts, where attackers first had to decompile deployed bytecode. AI lowers the cost of that decompilation significantly.

The thesis here is falsifiable. If Bitcoin Core and major Bitcoin-native hardware undergo comprehensive AI-assisted audits and turn up zero critical entropy or circuit-level vulnerabilities, the claim that legacy Bitcoin tooling carries material AI-exploitable blind spots is disproved. If Chainalysis's 440% dead-drop figure is revised significantly downward or the AI attribution is retracted, the macro threat framing weakens. Neither has happened.

What to Watch

Coinkite has shipped patched firmware. Migration is the user's responsibility. Watch for further attribution on the Coldcard sweep as investigators track fund flows. The broader question for the Bitcoin hardware and node-software ecosystem is whether proactive AI-assisted re-audits get scheduled before an adversary runs them first. Hornby showed how fast that window closes.

Sources

• TRM Labs: The Largest Hardware Wallet Exploit of 2026
• Chainalysis: Blockchain Dead Drops
• Chainalysis: Attackers Exploiting Unverified Smart Contracts
• SlowMist: Grok Exploitation and AI Agent Permission Chain Abuse
• Shielded Labs public statement (via @zooko on X)