A recent vulnerability exploit in Coldcard wallets has prompted Ledger's CTO, Charles Guillemet, to call for a reassessment of how random number generators are tested in Bitcoin storage devices. This incident highlights the flaws in the belief that "open code means verified code," as the vulnerability had been publicly known for over five years but went undetected until it was exploited.
Guillemet emphasized that open-source code does not guarantee verification, stating, "Open code and verified code are not the same thing." Ledger's devices utilize a hardware generator within a Secure Element to produce 256 random bits, but the Coldcard incident revealed the absence of a software backup, which contributed to the issue.
He also linked the exploit to the rising use of AI tools in software analysis, noting that these systems can accelerate the discovery of vulnerabilities for both attackers and defenders. However, there is no concrete evidence that the hackers used AI in this particular case. Reports on social media have suggested that the AI tool Claude Code identified the Coldcard vulnerability in just eight minutes.
