Coldcard security flaw cost AI only $2 to find

A security vulnerability in the Coldcard wallet proved so easy for an AI model to reproduce that the cost is estimated at just $2. Dragonfly Managing Partner Haseeb Qureshi draws a broader conclusion from this: the security of crypto products is increasingly determined by how much money companies invest in AI-driven security tests.

In brief:

• Haseeb Qureshi introduces the “Cost of Discovery” as a new benchmark for AI security tests
• The Coldcard vulnerability was reproduced by an AI model in approximately 20 minutes for about $2
• According to Qureshi, AI is fundamentally changing the economics of detecting security vulnerabilities

New benchmark: what does it cost an AI to find a vulnerability?

Qureshi introduces a new measurement method he calls the “Cost of Discovery”. It measures how cheaply an advanced AI model can replicate an existing vulnerability. For the Coldcard flaw, that amounts to about $2, which raises the question of how the sector deals with such low thresholds for detecting vulnerabilities.

Earlier, reports circulated that a Claude Code model found the vulnerability in just eight minutes. Qureshi adds caveats to this, because that model may have used a web search. A separate test with the offline GLM model reproduced the problem in approximately 20 minutes, without access to external information.

AI is changing the economics of crypto security

Qureshi states that this incident shows that the rules of the game around product security in the crypto sector are shifting. Whereas security audits used to be expensive and time-consuming processes, AI models can now expose vulnerabilities at lightning speed and at minimal cost.

That also means malicious actors can work with the same technology. Companies developing hardware wallets or other crypto solutions will therefore have to invest in AI-driven tests to keep up. Those who fail to do so run the risk that an attacker finds a flaw more cheaply than the company itself.