Rob Hamilton, who is building the automated setup the group runs, said in an X post the bottleneck is not finding bugs but routing them to the right maintainers.
“The hardest part is coordinating to get things to the right people,” Hamilton wrote. “While it is powerful, having found critical issues, I would view this as only version one.”
The audit lands in an ecosystem already absorbing the fallout when the other side finds a flaw first.
The Coldcard sweeps, which began July 30 and have taken as much as $114 million from wallets whose seeds were generated by faulty firmware, stemmed from a bug that had been dormant since 2021 and required no access to the physical device once the affected key space was known.
Attackers already have the same tools, however.
Anthropic said in April that one of its models, held back from public release and given only to vetted users, found a bug that had sat undiscovered in widely used software for 27 years, at a cost of less than $50. It found flaws in the encryption software that secures banking connections, exchange logins and the servers running most of the internet.
Separately, Google’s threat intelligence team said in May it had caught a criminal group preparing an attack built on a flaw a model had found for them.