How AI Is Reshaping Crypto Security, with Michael Coates
People typically move their crypto onto a hardware wallet in the name of security. This summer, that was the vulnerability. Starting July 30, attackers drained roughly $116 million in Bitcoin from more than 5,200 Coldcard wallets without ever touching a single device. The seed phrases those wallets generated were guessable, so all the care a wallet owner put into creating a private key of their own counted for nothing.
Michael Coates is Solana Foundation's new chief information security officer, and before that he was Twitter's first CISO. The Twitter role, back in 2014, put him against nation-states and the insiders they co-opted, cyber-criminals, hacktivists, and the crews that hijacked high-profile accounts to run crypto scams, while whistleblowers posting pseudonymously depended on him to keep them from being exposed.
On the latest episode of Bits to Bricks, he walks Amira Valliani through the hack, and through what he sees as a full shift in how security has to work.
What the Coldcard hack reveals about audits
A Coldcard builds a seed phrase, the string that derives your private key, from a random number. A March 2021 code change swapped the hardware random number generator for a software pseudo-random one. The code checked whether a value was set, not whether it was set to the right, secure source, and the audits confirmed only that the check ran. Seed entropy collapsed from 128 bits to about 40, small enough to brute-force offline. The flaw shipped in 2021 and sat undiscovered for more than four years, until this July's drain became the largest hardware-wallet exploit on record.
Even a careful developer makes subtle mistakes that a reviewer reads right past, which is why Coates says you never trust a single review. His practical rule is to weigh the pedigree of whoever builds your hardware. A small, well-meaning team can miss what a manufacturer with the staff and budget for layered testing would catch. AI shifts the odds on both sides now. A bug like that is exactly what an automated auditor, or an automated attacker, turns up in an afternoon.
How do you secure a crypto wallet properly?
Coates has heard "not your keys, not your crypto" plenty, and he doesn't argue with it. His caveat is that self-custody only works if you really know what you're doing, because there is no recourse when it goes wrong. What happens if your house catches fire, does your life savings burn with it? Say it's in a fireproof safe. Do you know the temperature that safe is rated for, and how long it holds?
Securing your crypto wallet should use the principle of no single points of failure. In practice that means multi-sig, where moving funds takes several keys, two of three or three of five, held on different hardware by different people. It also takes the air out of the wrench attack, the physical threat to one person, since no single holder can move everything on their own.
How does that work for a normal person, though? Does everyone need to teach their mom to co-sign transactions? Coates describes the idea of a trusted broker as one signer, (an educated spouse), or just geographic spread, with one device in a safe deposit box across town. Keep a single-signer wallet for small, everyday amounts, and don't forget the machine in front of you. People go deep on cold wallets and multi-sig, then never ask whether they run antivirus or update the OS.
Why AI shifts security to computer scale
Frontier AI models are gated for security work, but defenders are not getting access fast enough, and the open-source models a few months behind keep getting better at offense. Every month without the best model for defense, the freely available one improves at attack. Coates calls it cat and mouse, and right now the defenders are the ones trying to catch up.
Then there are deepfakes. He describes a finance employee pulled onto a video call with their CFO and two or three colleagues, all of them AI, none of them real, and millions wired to the wrong place. His answer comes from how we beat password phishing. You cannot out-train a user against an attack that looks pixel perfect; sooner or later they fall for it. So you take the failure out of their hands. Enter a password on a phishing site, reach over and tap a YubiKey, and nothing happens for the attacker, because the hardware only answers to the real site. "This is protecting the user from themselves," Coates says.
Nation-state threats and Solana's STRIDE response
The concern Coates carried to Congress and the Department of Homeland Security is the one he returns to most. He points to the espionage campaign Anthropic disclosed in November 2025, where a Chinese state group used Claude to run an operation across dozens of targets largely on its own. To him it is an old danger in a worse form. He goes back to Code Red, the self-propagating worm he responded to 25 years ago, and updates it. Instead of a worm crawling across vulnerable machines, self-organizing agentic adversaries move through systems on their own. People can still supply the clever breakthroughs, but no human is fast enough to be the one hands-on the keyboard. And it is unreasonable, he argues, to expect a Fortune 500, let alone the corner shop, to hold off Russia, China, Iran or North Korea alone. That defense has to move to the level of the state.
His answer for crypto is to build the automation before it is needed. At Twitter, anything that took two seconds was already 1.9 seconds too slow, so his team learned to make security outcomes happen in real time and automate them end to end. He wants the same instinct across crypto. STRIDE, the continuous security-rating program Solana Foundation launched in April for DeFi protocols, is part of it, and so are circuit breakers, code that trips on its own when something goes wrong, the way aviation and critical infrastructure already work.
The way it has always worked runs at human scale. The threats now run at computer scale, and most people and companies are still defending at human scale.
This article draws from our conversation with Michael Coates, Chief Information Security Officer at Solana Foundation. For the full discussion, listen to the episode of Bits to Bricks.