ONE AI REVIEW FOUND A FOUR-YEAR HOLE NOBODY HAD SPOTTED — ANOTHER LOGGED 85 FINDINGS AND WALKED PAST THE ONE THAT COST $116 MILLION

Two stories about machines reading old code, and they point opposite ways.

The first one worked. Zcash’s Orchard pool carried a counterfeiting flaw from the day it went live in May 2022 until an emergency fix on June 1, 2026. Four years and a month, through human audits, sitting there. From the disclosure: “Shortly after the release of Anthropic’s Opus 4.8 model on May 28, Taylor used it as part of a highly targeted review of the Orchard circuit.” One person, one narrow question, one model. Nothing was stolen.

The second one did not. Coinkite ran an enterprise AI review across its Coldcard firmware from May 1 to June 26, 2026. Its own log: “An enterprise AI review produced 85 candidate findings: 8 high, 37 medium, 20 low, and 20 informational.” The seed-generation weakness was not one of them. On July 30 that weakness was drained, and TRM Labs counts 1,816 bitcoin, about $116 million, out of more than 5,200 addresses in four waves. The first wave took roughly 594 coins in twenty-five minutes. The defect goes back to firmware shipped in March 2021.

The tell is in Coinkite’s own log, in the field where the finder is named: “Public incident investigation.” The theft found the bug. A scan that returns 85 findings and misses the one that empties wallets is not a security model. It is a receipt.