AI doesn’t need a quantum computer to weaken Bitcoin — it is already uncovering critical flaws across the crypto ecosystem in minutes and for a few dollars. Two developers interviewed by Cryptoast — an Ethereum engineer and a Bitcoin Core contributor — walk through this shift in the technological risk landscape, where the AI threat has become more immediate than the quantum one.
🔑 Key Takeaways
- One AI surfaced a multi-year bug in Coldcard wallets in 8 minutes, at an estimated compute cost of about $2.
- More than 1,596 BTC (≈ $100 million) were reportedly stolen through an entropy flaw introduced in 2021.
- Anthropic says Claude found a weakness in HAWK, a post-quantum signature candidate, in 60 hours for $100,000 of API usage.
- The quantum risk to Bitcoin remains distant (≈ a decade), according to Coinbase.
- AI mostly acts as a productivity multiplier for defenders and attackers alike.
AI Is Already Uncovering Critical Flaws Across the Crypto Ecosystem
For years, quantum computing has been framed as the main technological threat hanging over Bitcoin. Recent events show a more immediate risk, supercharged by AI, is already at work inside the code of wallets, clients and cryptographic libraries.
In late July, Anthropic’s Frontier Red Team announced that Claude Mythos Preview had discovered new attack methods against several algorithms. The model reportedly found a vulnerability in HAWK, a candidate for a future quantum-resistant signature standard. Despite two years of human review, Mythos identified in 60 hours an attack that cut the effective robustness of its keys in half. The experiment reportedly cost around $100,000 in API usage.
The recent BTC thefts hitting Coldcard users offered a concrete preview of what that acceleration means in practice. A bug introduced in 2021 had reduced the entropy of certain seeds generated by several Coldcard models. Several experts believe the attacker used an LLM to write the automation scripts, and possibly to discover the flaw itself.
The Coldcard Case: 8 Minutes and $2 to Find the Flaw
The most striking element isn’t the existence of the bug, but how easily an AI surfaced it. According to Haseeb Qureshi, an audit run with Claude identified the issue in eight minutes. A second experiment, run with another model, reproduced the finding in roughly 20 minutes at an estimated cost of about $2.
The vulnerability lived in the internal software of some Coldcard wallets. The bug reduced the randomness used when generating certain recovery phrases. For affected models, those phrases reportedly carried only about 40 bits of entropy, instead of the expected 128 bits. The bug sat at the intersection of separate components, outside the scope usually covered by audits. Taken in isolation, each piece of code looked correct — it was their interaction that created the flaw.
Coinkite stresses that such an error could remain invisible for several years in a product designed to offer the highest level of security. A flaw once undetectable is now AI-findable in minutes.
Why the Flaw Cost So Much
At the time of the events, more than 1,596 BTC (≈ $100 million) were reportedly stolen from Coldcard users. A software update alone cannot protect a key that has already been generated: funds must be moved to a new address whose key was produced with sufficient entropy. That inertia makes implementation errors particularly dangerous in the AI era.
AI Mostly Amplifies the Developer’s Capabilities
To gauge what this acceleration really changes, Cryptoast interviewed Amira Bouguera, an Ethereum developer and cryptographer, as well as a Bitcoin Core developer who asked to remain anonymous.
According to the Bitcoin Core contributor, the mistake would be to present AI as an autonomous intelligence necessarily superior to human researchers. He explains:
« Someone who isn’t very skilled will just produce 10 times more bad code, but a security expert can become 10 times more productive and find many more bugs. »
Bitcoin Core developer
AI would therefore mainly act as a productivity multiplier: more code reviewed, more scenarios tested, more attacks previously deemed too costly now within reach. The developer argues that current models bring mostly breadth rather than depth, expanding the volume of work without mechanically improving its quality.
On the Bitcoin Core side, the shift is already visible: more security reports, and many contributors who use AI on a daily basis.
AI and Quantum Threaten Bitcoin in Very Different Ways
The risk posed by a quantum computer is direct and potentially devastating for Bitcoin, and for finance more broadly. No machine capable of running such an attack exists today. According to Coinbase, it will likely take a decade or more before quantum computers affect current cryptographic protocols.
AI, by contrast, is already in play. It doesn’t yet break ECDSA or Schnorr, but it accelerates the discovery of errors inside clients, wallets, cryptographic libraries and the very post-quantum standards meant to protect Bitcoin tomorrow.
Amira Bouguera downplays any immediate threat following Anthropic’s announcement:
« The risk for blockchains is practically zero today, at least as a result of this announcement. But it shows things are moving very fast. We need to start using these tools to find vulnerabilities before someone else does. »
Amira Bouguera, cryptographer and Ethereum protocol engineer
With HAWK, the AI didn’t use a quantum computer to attack Bitcoin. It found a defect in an algorithm specifically designed to protect digital systems against the future quantum threat — proof that the migration target is already in scope.
Side-by-Side Comparison
| Criterion | AI | Quantum computing |
|---|---|---|
| Availability | Already operational | Not before ~10 years |
| Main target | Implementations, bugs, audits | ECDSA, Schnorr, RSA |
| Cost of an attack | A few dollars of API usage | Billions in hardware |
| Impact surface | Wallets, clients, PQ standards | Core cryptographic primitives |
| Defence available today | AI audits, formal review | Post-quantum migration |
AI Also Compresses the Quantum Roadmap
Beyond bug hunting, AI could compress the quantum timeline itself. Alex Pruden, CEO of Project Eleven, says:
« The security landscape of tomorrow will be different. Between quantum and AI, we’re moving into a world where security — and this goes well beyond crypto — simply can no longer be delivered the way you used to. »
Alex Pruden, CEO of Project Eleven
Illia Polosukhin, co-founder of NEAR Protocol, agrees:
« AI is increasingly becoming an accelerator. The pace of research will pick up from now on, and we’ve already seen breakthroughs people didn’t expect to surface this soon. »
Illia Polosukhin, co-founder of NEAR Protocol
He notes that researchers already use models to optimize quantum error correction, one of the main engineering bottlenecks in the field. This convergence is pushing several ecosystems — Ethereum, Zcash, Solana, Ripple and NEAR — to prepare a post-quantum migration today. NEAR has announced the integration of post-quantum cryptography directly into its account infrastructure, allowing users to rotate cryptographic schemes without migrating their assets. Zcash has also rolled out the Tachyon upgrade to improve shielded payments and quantum readiness.
Polosukhin also warns of the so-called « collect now, decrypt later » strategy: state and private actors are already harvesting encrypted traffic in anticipation of a future decrypt. Pruden confirms: AI is being used to accelerate quantum computing research, notably around error correction.
Open Source Under AI Pressure
The Coldcard case also revives the open source debate. Publishing your code doesn’t guarantee that a piece of software is secure: it only guarantees that its behaviour can be inspected. In the AI era, an unaudited public repository becomes an easy target for attackers who can cross-reference the code, documentation, GitHub history and discussions in a matter of hours.
Some draw a paradoxical conclusion: bitcoins would now be safer on a large centralized platform, staffed with specialized teams, surveillance systems and multisig custody. But that conclusion runs directly counter to Bitcoin’s founding ethos of reducing trusted intermediaries.
The Bitcoin Core developer highlights the social asymmetry introduced by AI:
« Where the asymmetry gets larger is on the social side. Maintainers risk being buried under change requests that aren’t priorities and pull attention away from more important topics. »
Bitcoin Core developer
The lesson from Coldcard is not that proprietary software is safer, but that an open source project can no longer rely on community review alone. In the AI era, publishing your code carries an additional responsibility: testing it at least as hard as attackers will test it.
Conclusion: A Speed Race, Not an Apocalypse
AI does not, at this stage, break Bitcoin’s cryptography. It does not threaten ECDSA or Schnorr. What it does is make exploitable in minutes, and for a few dollars, bugs that have been sitting dormant for years inside reference products. The quantum risk, meanwhile, remains a long-term structural threat — still waiting for the concrete weapon that could turn it into reality.
The coming months will show whether crypto ecosystems can deploy AI in defence faster than attackers do in offence. Security, the experts insist, can no longer be a static infrastructure refreshed every ten years: it will become a continuous process, with constant budget and rising intensity.
Sources
- Cryptoast — Bitcoin: Is AI more dangerous than quantum?
- CoinDesk — AI Is Speeding Up the Quantum Threat to Crypto Security
- Coinbase Learn — Is Quantum Computing a Threat for Crypto?
- Symbole — Coldcard: when AI makes open-source code dangerous
This article is for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
