[DigitalToday reporter Yoonseo Lee (이윤서)] A view has emerged that bitcoin's near-term security threat is closer to vulnerabilities in custody structures involving wallets, firmware and recovery procedures than to quantum computers cracking encryption.

On Aug. 4 (local time), blockchain media outlet CryptoSlate reported that growing awareness is spreading that even cold storage needs to be re-examined, as artificial intelligence is increasingly likely to find gaps in the software and hardware surrounding private keys faster than in the private keys themselves.

A representative example is technical material released by Coinkite on July 30. Coinkite said that after a software change in 2021, some wallets used a MicroPython-based software method, rather than a hardware random number generator, when creating seeds.

It later added some random values generated by a security chip in the model, but even installing new firmware does not protect seeds that were already created. If a separate method of generating randomness, such as dice input, was not used, users need to create a new seed and move funds to a new wallet. The case shows that even a cold wallet, supply chains, builds and firmware verification do not guarantee security.

The signing process is not completely safe either. On Dec. 14, 2023, a distributed package containing malicious code was circulated for Ledger's software tool, Connect Kit, prompting users to sign transactions that siphoned off assets. Ledger said its core infrastructure, code repository and connected decentralised applications themselves were not compromised. Still, it showed that malicious software can reach the step just before final approval is pressed on a hardware wallet.

The "air-gapped" method of using devices completely disconnected from the internet also has limits. Even if a device is cut off from the network, signed transaction data ultimately has to be sent outside. Researchers demonstrated that using the Dark Skippy technique, seed information can be hidden inside 2 normal bitcoin transaction signatures. It appears to be a normal signature, but the information inside could allow the seed to be leaked.

Risks targeting hardware itself have also been confirmed. In research released on July 9, Ledger's security research unit Ledger Donjon said it could bypass Tangem wallet firmware recovery status checks using a laser fault injection method. It said the attack is unlikely to lead to a typical attack because it requires physical access to a device, a high level of expertise and equipment worth about $250,000. Even so, it shows that a secure chip does not mean the whole wallet is secure, and that firmware operation also needs to be verified.

Recovery functions also create new dependencies while improving convenience. Ledger Recover, if a user applies, splits and stores encrypted seed fragments across multiple backup companies. In that case, outside companies intervene in identity verification, processing recovery requests and restoring on a new device. It means it is difficult to explain all risks of cold storage solely by keeping private keys offline.

AI was cited as a variable that could find such vulnerabilities faster. OpenAI released internal benchmark results on July 21 and said a model with lowered cyber-related refusal settings found multiple vulnerabilities across a research environment and Hugging Face's operating infrastructure and linked them in sequence. It said this is at an early stage, with additional investigation and external evaluation under way.

Hugging Face also disclosed on July 16 that its operating environment had been compromised and provided the status of its impact assessment. The target was software infrastructure, not bitcoin wallets or cryptographic technology itself. Even so, it drew attention because it suggested AI could link different vulnerabilities to form attack paths.

A similar flow appeared in areas closer to cryptocurrencies. Cerberus, disclosed on June 17, is a security inspection system in which multiple AI agents and security experts explore vulnerabilities in wallets and payment software. It differs from technology that autonomously recovers seeds, but was presented as an example of how AI could increase the speed of finding defects in wallet software.

Coinkite said in its disclosure that AI could bring forward vulnerability discovery, but called it a "hypothesis". It also said it conducted an auxiliary review using AI but failed to find the bug. For now it is difficult to conclude that AI can find all defects, but the possibility is growing that it can reduce the time lag between coding mistakes and the discovery of actual vulnerabilities.

Ultimately, the key is not whether bitcoin's cryptographic system collapses, but how quickly human-centred custody structures, from seed generation to storage and recovery, are inspected and improved. The original text assessed that bitcoin's cryptographic foundations are still holding.

But actual pressure is already being applied to custody equipment and operating procedures designed by humans. It said the strength of cold storage can be maintained only when there are preparations for which layer to trust and how to transfer and recover assets if problems occur.