The Attack Surface Is the Infrastructure

What the Coldcard Breach Reveals About the Next Era of Cyber Risk

This publication is for informational purposes only and does not constitute investment advice. Blonde Capital may hold positions in discussed assets. Capital is at risk.

Photo by Jon Hodl on Unsplash

On July 30, 2026, more than 1,000 Bitcoin wallets were drained in a series of attacks that rapidly expanded into one of the most consequential security incidents in the history of the hardware-wallet ecosystem. The wallets were not exchange accounts. They were not sitting on a centralized cryptocurrency platform. They were associated with Coldcard, a hardware wallet specifically designed to keep Bitcoin private keys isolated from internet-connected systems. The incident was subsequently linked to a vulnerability affecting the generation of wallet recovery seeds in certain Coldcard firmware. The fundamental problem was not that Bitcoin’s blockchain had been compromised, but that the mechanism responsible for generating the secret credentials controlling Bitcoin had been weakened. Public estimates of the funds stolen have continued to rise as researchers trace additional transactions, with losses eventually moving beyond $100 million and public estimates exceeding $130 million as of early August, although the precise total remains subject to ongoing blockchain analysis (TechCrunch; AltcoinBuzz).

The distinction matters as this was not a failure of Bitcoin’s underlying blockchain consensus mechanism. The Bitcoin ledger was not hacked. The cryptographic rules governing the network were not broken. Rather, a vulnerability existed in software responsible for generating the credentials that allow an individual to control Bitcoin. The blockchain functioned exactly as designed: whoever possessed the valid private keys could move the coins. Coldcard’s subsequent security guidance made clear that users who had generated seeds under affected firmware could not simply rely on a firmware update to repair an already-created seed; affected users needed to migrate funds to newly generated, secure seeds. The company’s emergency remediation therefore reinforced the central lesson of the incident: the security of an asset is only as strong as the entire chain of processes through which control over that asset is established and maintained (Coinkite).

That is precisely what makes the incident important. The Coldcard event exposes a weakness that extends far beyond Bitcoin. Modern society increasingly treats software as infrastructure. We use software to generate financial credentials, control water treatment systems, authorize payments, manage electrical grids, communicate with executives, operate industrial equipment, and increasingly make decisions on behalf of humans. The physical infrastructure may remain intact while the software layer controlling it becomes the point of failure. A water treatment plant may still have pumps, pipes, reservoirs, chemicals, and employees. A bank may still possess sufficient capital. A corporation may still possess its physical assets. A Bitcoin network may still be operating perfectly. Yet the software and authentication layers that determine who can control those assets may introduce a completely different category of risk.

The most consequential development is not simply that vulnerabilities exist. They always have. The consequential development is that the economics of discovering vulnerabilities are changing. Artificial intelligence is reducing the amount of specialized human labor required to search enormous quantities of code, identify anomalous behavior, reproduce vulnerabilities, and potentially construct exploits. The same technology is simultaneously becoming one of the most powerful tools available to defenders. Cybersecurity is therefore moving from a relatively static contest between attackers and defenders toward an accelerating arms race in which both sides can use machines to examine systems at a scale previously unavailable to humans. Recent research demonstrates that AI systems are already being used to identify previously unknown vulnerabilities, including vulnerabilities involving cryptographic misuse, while major AI developers are increasingly evaluating whether frontier models possess the ability to discover and exploit zero-day vulnerabilities autonomously (Villa et al.; Reuters).

The Coldcard incident should therefore be viewed less as an isolated cryptocurrency failure and more as a preview. It offers a glimpse into what happens when an apparently secure system contains a small weakness, that weakness remains undiscovered for years, and the economics of finding it suddenly change. The important question is not whether another Coldcard will occur. It is where the next equivalent weakness will appear, how quickly it will be discovered, how rapidly it can be exploited, and how far the consequences can propagate through systems that were never designed to fail simultaneously.

What Actually Happened to Coldcard?

For years, one of Bitcoin’s most important security principles has been summarized in six words: not your keys, not your coins. Hardware wallets emerged from this principle. Rather than leaving private keys on an internet-connected computer or exchange, a hardware wallet is intended to isolate sensitive signing information. The security model is straightforward: if an attacker cannot access the private key, the attacker cannot authorize a Bitcoin transaction.

Coldcard was designed around precisely this philosophy. The vulnerability demonstrated why security is not a single property of a device. It is a chain.

A hardware wallet can be physically isolated from the internet and still be compromised if the process that generates its secret material is flawed. In this case, researchers identified a problem affecting the generation of recovery seeds in certain versions of Coldcard firmware. The vulnerability did not require an attacker to physically possess every affected device. Instead, the weakness reduced the effective unpredictability of certain seeds, making it possible for attackers to derive or brute-force vulnerable wallet credentials and subsequently move the associated Bitcoin. Coldcard’s emergency remediation distinguished between affected devices and also emphasized that users who had generated seeds under affected firmware needed to migrate to newly generated seeds rather than assuming that a firmware update alone repaired the underlying exposure (Coinkite).

This is a crucial distinction for non-specialists. The attacker did not need to “break Bitcoin.” The attacker needed to break the mechanism that produced the secret that controlled Bitcoin. The difference is analogous to a bank vault whose steel door is effectively impenetrable, but whose key-generation machine has been quietly producing duplicate keys. The vault did not fail. The key-generation system did.

That distinction also explains why describing the incident simply as a “Bitcoin hack” is technically misleading. Bitcoin’s base layer continued to validate transactions according to its existing rules. No attacker acquired the ability to rewrite the blockchain, counterfeit Bitcoin, or alter the consensus rules. Instead, attackers obtained legitimate authorization credentials belonging to individual users. The network then performed exactly what it was designed to do: it recognized valid signatures and settled the resulting transactions. In this sense, the incident is less a failure of Bitcoin’s core cryptography than a demonstration of how security assumptions surrounding a protocol can become weaker at the edges.

Coinkite subsequently warned that simply updating firmware was insufficient for users whose recovery phrases had already been generated using affected firmware. Those users needed to generate a new recovery phrase and migrate their funds. Coldcard’s firmware documentation and security architecture also emphasize signed releases and firmware verification, underscoring the broader reality that even security-focused hardware depends upon a complex software supply chain (Coinkite).

This is the first lesson of the incident: Security is not a feature. It is a system and systems fail at their weakest interfaces.

The More Important Reaction Is Happening After the Hack

The immediate financial loss is significant. More important, however, is what happened next. A major Bitcoin security incident has a tendency to produce an unusual response because Bitcoin is not a single company. It is an ecosystem of independent developers, wallet manufacturers, exchanges, payment processors, Lightning implementations, custody providers, node software, signing devices, and other layers that collectively form the infrastructure through which users interact with Bitcoin. The protocol itself may be decentralized, but the software surrounding it is an enormous web of dependencies maintained by different organizations, developers, and communities.

When one layer fails, participants begin asking a much more uncomfortable question: What else have we assumed was secure without actually proving it?

That question has driven a broader defensive examination of Bitcoin-related software and infrastructure following the Coldcard incident. Security researchers and developers have been examining code paths, dependencies, wallet implementations, signing mechanisms, and related systems. The objective is not necessarily to demonstrate that every component is vulnerable. The objective is to discover vulnerabilities before someone else does. This distinction is particularly important because reports of weaknesses in adjacent Bitcoin infrastructure should not automatically be interpreted as proof that every affected system has been compromised. The broader significance is that the incident has changed the incentive structure around auditing. Developers now have greater reason to assume that an adversary may be looking at the same code they are looking at, potentially with increasingly capable automated tools.

This distinction is important because it changes the meaning of the incident. A vulnerability that remains undiscovered for five years is one thing. A vulnerability that becomes discoverable in five hours is something entirely different. The software itself has not necessarily become less secure. The rate at which humans and machines can interrogate that software has changed. That is the emerging phenomenon that matters.

Researchers have already demonstrated that vulnerabilities in cryptocurrency ecosystems can propagate well beyond the original codebase. Academic research examining cryptocurrency projects has found that vulnerabilities patched in Bitcoin can remain unpatched in derivative projects, sometimes for extended periods. Another body of research has examined the propagation of vulnerabilities across blockchain forks and demonstrated how inherited code can transmit security weaknesses into downstream systems (Choi et al.; Andreina et al.). The lesson extends beyond cryptocurrency. Modern software is rarely written entirely from scratch. Applications rely on libraries, frameworks, operating systems, APIs, cloud infrastructure, authentication services, and third-party vendors. A vulnerability can therefore travel through a software ecosystem without the organizations using the affected component fully understanding that they have inherited the risk.

In other words, software ecosystems possess something analogous to biological inheritance. A vulnerability can reproduce. This is the beginning of what we might call the attack surface economy: an economy in which the value and reliability of an asset increasingly depend not only on what the asset produces, but on the number, complexity, and security of the digital dependencies required to keep it functioning. The larger the dependency graph becomes, the greater the number of places where trust can fail. What appears from the outside to be a single product or service may actually be the visible endpoint of hundreds or thousands of underlying components.

The result is a paradox. Technology has allowed organizations to become dramatically more efficient by outsourcing, integrating, automating, and connecting. Those same efficiencies can increase systemic exposure because the organization may no longer control or even fully understand every component upon which its operations depend.

AI Changes the Economics of the Attack

For most of the history of cybersecurity, sophisticated vulnerability discovery required scarce human expertise. An attacker needed to understand the architecture. They needed to locate the relevant code. They needed to identify an unexpected behavior. They needed to reproduce it. They needed to determine whether it could be weaponized. They often needed specialized knowledge of operating systems, cryptography, networking, hardware, or application architecture. That scarcity created friction. AI reduces that friction.

The emerging generation of AI systems can analyze code, identify suspicious patterns, generate test cases, reason across large codebases, assist with reverse engineering, and automate portions of vulnerability research. Academic work published in 2026 demonstrates that agentic AI can be used to identify cryptographic misuse vulnerabilities by examining not merely individual applications but the dependency relationships through which vulnerabilities can propagate. The researchers behind Chai reported that their system discovered a previously unknown critical vulnerability in an SSL library used across billions of devices, along with additional vulnerabilities in libraries used by major browsers and Linux distributions (Villa et al.). The significance is not that AI has suddenly become omnipotent. It is that the machine can now participate in a portion of the vulnerability-discovery process that previously required highly specialized human labor. The economics change accordingly.

Cybersecurity historically benefited from the fact that attacking a system was expensive. AI is making certain forms of attack cheaper. But it is also making defense cheaper. The same models that can examine code for attackers can examine it for defenders. AI can search millions of lines of code, compare implementations, identify anomalous patterns, generate test cases, and assist humans in prioritizing vulnerabilities. The cybersecurity industry is therefore entering a period in which the limiting resource may no longer be the ability to inspect code, but the ability to determine which findings actually matter and which represent false positives, theoretical vulnerabilities, or low-impact defects.

This creates what might be called the vulnerability half-life problem. A vulnerability can exist for years without being exploited because the economic and technical conditions required to discover or weaponize it do not yet exist. Once those conditions change, the vulnerability’s practical value can change rapidly. A weakness that was relatively obscure in 2022 may become highly consequential in 2026 if AI makes it easier to locate, reproduce, and exploit. The underlying code did not suddenly become more vulnerable. The cost of discovering the vulnerability changed.

This is one reason the emerging AI cybersecurity arms race is so important. Recent reporting indicates that frontier AI systems are increasingly being evaluated for their ability to autonomously identify and exploit zero-day vulnerabilities, with OpenAI recently flagging potential “critical” cybersecurity capabilities in an upcoming model and tightening its internal safeguards as a result (Reuters). Whether any individual system ultimately crosses that threshold is less important than the direction of technological development. The strategic value of AI increasingly includes its ability to interact with software systems rather than merely describe them.

The implication is profound. Cybersecurity historically benefited from the fact that attacking a system was expensive. AI is making certain forms of attack cheaper. But it is also making defense cheaper. The same technology can be pointed in either direction. This produces an uncomfortable equilibrium. AI is not simply increasing cyber risk. It is increasing the velocity of cybersecurity itself. The question is no longer whether a vulnerability exists. The question increasingly becomes: Who finds it first?

The Software Supply Chain: You Do Not Have to Attack the Thing You Want

The Coldcard incident also illustrates a broader principle of modern cybersecurity: an attacker does not necessarily need to attack the asset they ultimately want. They can attack something that asset trusts.

Modern software is assembled from layers. An application may rely on dozens of open-source libraries. Those libraries may rely on other libraries. Authentication may be delegated to an outside provider. Data may be hosted by a cloud company. Payments may be processed by a third party. DNS may be controlled by another provider. Employees may authenticate through a centralized identity platform. Developers may collaborate through external code repositories. A security product may itself depend on other software. This creates a supply chain of trust.

The SolarWinds compromise demonstrated how a sophisticated adversary could exploit trust in a software vendor to reach downstream organizations. The Log4Shell vulnerability demonstrated the opposite dynamic: a widely used open-source component could become a systemic vulnerability because it was embedded in an extraordinary number of applications. The XZ Utils incident demonstrated how even a seemingly obscure open-source dependency could become strategically significant when it sits within a critical software stack. These incidents matter because they challenge the traditional definition of diversification.

A company may have ten different software applications and still possess a single point of failure if all ten rely on the same underlying cloud provider, identity system, software library, or communications infrastructure. This is security monoculture. The appearance of diversification can therefore be misleading. Ten applications are not ten independent systems if they all depend upon the same underlying infrastructure. Ten banks are not necessarily ten independent financial systems if they share the same critical software dependency. Ten utilities are not ten independent infrastructure systems if they rely upon the same vendor, remote-management platform, or authentication architecture. The implication is straightforward: correlation exists beneath the asset level.

Trust Concentration May Become More Important Than Capital Concentration

Financial markets have spent decades studying concentration risk. Investors measure portfolio concentration, customer concentration, geographic concentration, supplier concentration, and revenue concentration. Yet one of the most consequential forms of concentration may be largely invisible on a traditional balance sheet: trust concentration. An organization can diversify its assets while concentrating its trust. One identity provider. One cloud provider. One payment processor. One communications platform. One software dependency. One hardware vendor. One executive authorization chain.

From an accounting perspective, these may appear as ordinary vendors and operating expenses. From a systemic-risk perspective, they represent dependencies upon which the organization’s ability to function may rest. This creates an important distinction between financial diversification and operational diversification. A company may have diversified revenue across hundreds of customers while maintaining a single software dependency that could interrupt operations across every customer relationship simultaneously. An investor may own twenty companies while those companies share the same cloud infrastructure, payment rails, or cybersecurity provider. The portfolio appears diversified at the security level but concentrated at the infrastructure level. The next generation of systemic risk may arise not from concentrated capital, but from concentrated dependencies and the trust placed in them.

That concept is especially relevant to Bitcoin because Bitcoin is often described as a trust-minimized financial system. At the protocol level, that description has substantial merit. But the ecosystem through which most people actually use Bitcoin contains numerous trust relationships: hardware manufacturers, software developers, wallet implementations, exchanges, custody providers, operating systems, signing devices, backup procedures, and human operators.

The Coldcard incident therefore exposes an important paradox. A system can minimize trust in the settlement layer while still accumulating trust dependencies at the interface layer. The blockchain can be decentralized while the infrastructure used to access it remains concentrated.

From Bitcoin to Water

This is where the Coldcard incident becomes much larger than Bitcoin. Bitcoin is unusually visible because the consequences are immediate and measurable. A vulnerability can result in millions of dollars moving across the blockchain within minutes.

Critical infrastructure operates differently. The attack may not produce a visible financial transaction. Instead, a pump stops. A treatment system behaves incorrectly. A water tower fails to refill. A control system becomes inaccessible. A utility loses visibility into its own operations. These events may appear mundane until their dependencies are understood.

In 2024, the Environmental Protection Agency warned that cyberattacks against drinking-water systems were increasing in both frequency and severity. EPA inspections identified problems including default passwords, inadequate access controls, insufficient asset inventories, and vulnerabilities in operational technology. More than 70 percent of systems inspected since September 2023 were found to be in violation of basic cybersecurity requirements (Environmental Protection Agency). A separate EPA Inspector General assessment found that, among 1,062 drinking-water systems serving more than 193 million people, 97 systems had critical or high-risk cybersecurity vulnerabilities and another 211 systems had medium- or low-risk findings involving externally visible portals (Environmental Protection Agency). The problem has not disappeared.

In February 2026, the EPA reported that it had identified cybersecurity vulnerabilities at 277 water systems during 2025 and helped eliminate 350 vulnerabilities. The agency specifically noted that technologies controlling drinking-water and wastewater processes were attractive targets and emphasized the importance of reducing exposure of operational technology to the public internet, maintaining asset inventories, and implementing strong authentication protocols (Environmental Protection Agency). Then the problem became geopolitical.

In April 2026, the EPA, FBI, CISA, and NSA issued a joint advisory warning that Iranian-affiliated cyber actors were exploiting and, in some cases, disrupting commonly used operational technology at drinking-water and wastewater systems in the United States (Environmental Protection Agency).

In July, a cyberattack temporarily disrupted the water system of Braham, Minnesota, a town of approximately 1,800 people. The incident occurred during a heatwave and became part of a broader investigation into cyber activity affecting small communities. The event did not produce lasting physical damage, but it demonstrated how quickly a remote cyber event can become a physical infrastructure problem for an ordinary community (Wall Street Journal). This is the infrastructure version of the Coldcard problem. The water does not need to be “hacked.” The software controlling the water system does.

The Human Layer Is Now an Attack Surface

The same pattern is appearing in finance. Software does not have to be directly compromised if a human can be persuaded to authorize the action. This is where synthetic voice, deepfakes, and AI-generated communications become particularly dangerous.

Traditional phishing depended upon deception that humans could sometimes detect: a suspicious email, an unfamiliar sender, an awkward sentence, a strange request. AI is progressively eliminating those signals. A convincing synthetic voice does not need to be indistinguishable from a real executive. It only needs to be sufficiently convincing to cause an employee to suspend normal verification procedures.

The implications extend beyond individual scams. Financial institutions, corporations, family offices, and governments have historically relied upon human recognition as one layer of authentication. A known voice, familiar email address, recognizable face, or established communication pattern could provide confidence that a request was legitimate. AI weakens each of these assumptions simultaneously.

This represents what may become an authentication collapse. The traditional question was: “Can I recognize the person?” The emerging question is: “Can I independently verify the authorization?” That distinction is becoming foundational.

A voice is no longer proof of identity. A video is no longer proof of identity. A familiar email address is no longer proof of identity. Even a plausible conversation may no longer be proof of identity. The security architecture has to assume that the human layer can be simulated.

The consequence is not that humans become irrelevant. It is that human recognition can no longer serve as the final security control for high-value actions. Independent verification becomes more important: separate communication channels, transaction limits, dual authorization, hardware-based credentials, time delays, and procedures requiring a second source of confirmation.

The principle is similar to diversification in finance. If the same information source determines both whether an action is legitimate and whether it should be executed, the organization has concentrated too much authority in a single channel.

Cybersecurity Is Becoming a Form of Warfare

The convergence of AI, software dependency, financial infrastructure, industrial control systems, and geopolitical conflict creates a new category of systemic risk. Cyberwarfare does not require a missile.

It can begin with a credential. It can begin with a software dependency. It can begin with a forgotten server. It can begin with an unpatched industrial controller. It can begin with an employee receiving a phone call that sounds exactly like someone they trust. And increasingly, the attacker can use AI to identify which weakness is worth exploiting.

The World Economic Forum has increasingly framed cybersecurity as a strategic and geopolitical issue rather than merely an information-technology problem, while U.S. agencies have explicitly warned that foreign actors are targeting operational technology in sectors such as water. The April 2026 joint advisory from the EPA, FBI, CISA, and NSA is particularly significant because it connects cyber activity directly to geopolitical conflict and physical infrastructure (World Economic Forum; Environmental Protection Agency).

This is where cyberwarfare begins to resemble gray-zone warfare. An adversary does not necessarily need to destroy infrastructure permanently. It may be sufficient to demonstrate that it can disrupt it, impose uncertainty, force emergency spending, create public fear, or consume defensive resources. The strategic objective can be psychological or economic rather than purely destructive.

A cyberattack against a small water system, for example, does not need to contaminate an entire city to have strategic significance. If residents begin to question whether their water is safe, if emergency responders have to intervene, if local officials must divert scarce resources, and if neighboring systems become concerned about their own exposure, the attack has produced consequences far beyond the original technical intrusion.

This is cascading failure. The first-order cost is the breach. The second-order cost is the response. The third-order cost is the loss of confidence. The fourth-order cost is the capital required to rebuild trust. The total economic impact can therefore be dramatically larger than the initial theft or disruption.

That principle applies equally to financial markets. A cyberattack against a financial institution may not need to steal enough money to threaten solvency. If it causes customers or counterparties to question whether the institution can process withdrawals, settle transactions, or protect balances, the primary threat becomes confidence. A technically secure institution can experience a crisis generated by the perception that it is insecure. Cybersecurity therefore intersects directly with liquidity risk. Cyber risk can become confidence risk. Confidence risk can become liquidity risk.

The Coming Problem Is Not That Everything Will Be Hacked

It is tempting to reach a catastrophic conclusion. That would be a mistake. The existence of vulnerabilities does not mean that every system will fail. Nor does the Coldcard incident demonstrate that every Bitcoin wallet, water utility, financial institution, or AI system is fundamentally insecure. The more useful conclusion is different: We should stop designing systems around the assumption that vulnerabilities will not be discovered. They will. The strategic question is what happens when they are.

A resilient system assumes compromise. It limits the blast radius. It separates critical functions. It requires multiple independent forms of authorization. It maintains offline recovery mechanisms. It inventories dependencies. It continuously tests its assumptions. And it avoids concentrating too much value behind a single point of failure. This is where cybersecurity begins to resemble financial risk management.

An investor does not diversify because every company is expected to fail. The investor diversifies because they do not know which company will fail. The same principle applies to infrastructure.

But the concept needs to be expanded. Diversification is not merely about owning different assets. It is about avoiding shared dependencies that can fail simultaneously. A portfolio of twenty companies can still possess significant systemic exposure if every company depends upon the same cloud infrastructure, payment network, identity provider, software library, or geographic region. Similarly, an infrastructure network can appear redundant while relying upon the same underlying vendor or remote-access system. The relevant question is therefore not simply, “How many systems do we have?” It is, “How many independent systems do we actually have?” That is the difference between apparent redundancy and real redundancy.

The Only Offense Is Risk Management

The central lesson of the Coldcard incident is therefore not “do not use hardware wallets.” It is not “Bitcoin is broken.” It is not even “AI is dangerous.” The deeper lesson is that trust must become probabilistic rather than absolute.

There is no perfectly secure wallet. There is no perfectly secure software stack. There is no perfectly secure financial institution. There is no perfectly secure water system. There is no perfectly secure human authentication mechanism. And there is certainly no perfectly secure AI system. The appropriate response is not paralysis. It is diversification.

For individuals, this can mean avoiding the concentration of meaningful wealth in a single wallet implementation or security assumption. For businesses, it means separating authorization from execution, maintaining independent communication channels, and requiring multiple forms of verification for high-value transactions. For critical infrastructure, it means reducing unnecessary internet exposure, maintaining inventories of operational technology, implementing strong authentication, exercising recovery plans, and ensuring that a cyber incident does not automatically become a physical catastrophe (Environmental Protection Agency). For investors, it means something broader. The cyber layer itself is becoming an investment variable.

A company may have excellent financial statements and still possess enormous technological concentration risk. A utility may have abundant physical capacity but insufficient digital resilience. A financial institution may have sophisticated encryption while remaining vulnerable to social engineering. A software company may have excellent engineers while depending upon hundreds of external libraries that it does not control. The balance sheet increasingly has a shadow balance sheet: the architecture of what can fail. That architecture is becoming economically important.

This creates the possibility of a resilience premium. Markets traditionally reward growth, margins, capital efficiency, scale, and recurring revenue. Increasingly, investors may also need to evaluate redundancy, cybersecurity, supply-chain diversity, offline recovery, geographic diversification, vendor independence, and operational resilience. Two companies can generate identical EBITDA while possessing radically different failure profiles.

Consider two hypothetical companies with identical revenue and margins. The first depends upon a single cloud provider, a single payment processor, a single identity platform, and one geographic operating region. The second maintains multiple infrastructure providers, redundant payment rails, independent backups, geographically distributed operations, and diversified suppliers. Their income statements may look nearly identical. Their risk-adjusted enterprise values should not.

This suggests a broader investment thesis: the market may be entering an era in which resilience becomes an economically valuable asset rather than merely an operating expense. The companies that can absorb disruption without losing the ability to operate may ultimately deserve a premium over companies that are more efficient but more fragile.

This is not an argument for inefficiency. Redundancy has a cost. Maintaining multiple systems, backup infrastructure, independent vendors, and additional security controls can reduce short-term margins. But the correct comparison is not between efficiency and inefficiency. It is between the cost of resilience and the expected cost of failure.

For decades, financial markets rewarded companies for eliminating excess capacity. Just-in-time manufacturing, lean staffing, centralized infrastructure, and vendor consolidation created enormous efficiencies. The problem is that efficiency and resilience can sometimes move in opposite directions. A system optimized for normal conditions may be poorly equipped for abnormal conditions.

The next phase of capitalism may therefore place a greater value on optionality. The ability to switch vendors. The ability to operate offline. The ability to authenticate independently. The ability to move capital through another rail. The ability to recover without the original infrastructure. The ability to continue operating when one component fails. Resilience is, in this sense, a form of optionality.

The Future Is Not Less Secure. It Is Less Forgiving of Concentrated Risk.

The Coldcard incident is easy to misunderstand because Bitcoin makes the consequences visible. More than $100 million can move. Wallets can be emptied. Transactions appear on a public ledger. The numbers are immediate. But the underlying phenomenon is much larger.

Across water systems, financial institutions, software platforms, industrial controls, communications networks, and artificial intelligence itself, society is accumulating an extraordinary amount of complexity on top of software. Complexity creates dependencies. Dependencies create attack surfaces. And AI is increasing the speed at which both attackers and defenders can search those surfaces.

The result will not necessarily be a world in which everything is hacked. It will be a world in which the cost of discovering what is vulnerable falls dramatically. That distinction matters. The old security model was built around scarcity: there were only so many skilled researchers, only so many hours in the day, and only so many systems an attacker could manually examine. The new model is built around scale. Machines can examine what humans cannot. That creates an arms race. But it also creates an opportunity.

The same technology capable of finding weaknesses can find them before an adversary does. The same AI capable of impersonating a voice can detect an impersonation. The same automated systems capable of probing infrastructure can continuously test defensive systems. The same transparency that exposes vulnerabilities can allow communities to repair them.

This is perhaps the most important reason not to interpret the current moment as an inevitable technological collapse. The same declining cost of attack can produce a declining cost of defense. Small organizations that previously lacked the resources to employ large cybersecurity teams can use AI to continuously examine code, monitor networks, summarize anomalies, and assist with incident response. The asymmetry between large and small organizations may therefore change in unexpected ways.

The future, therefore, is not necessarily less secure. It is less forgiving of concentrated risk. That is the distinction investors, executives, policymakers, and ordinary individuals should understand. The objective is not to build a system that can never be attacked. The objective is to build a system that can be attacked without collapsing. That is the essence of resilience.

The Future Belongs to Resilient Systems

The Coldcard incident provides an unusually clear window into a much larger transformation. Bitcoin was not fundamentally broken. The blockchain did not fail. The cryptographic settlement layer continued to operate. What failed was a component of the infrastructure responsible for generating the credentials that allowed individuals to exercise control over their assets. That distinction is not a technical footnote. It is the central lesson.

Modern systems increasingly depend upon layers of software that users never see and often do not understand. The visible asset is only the final layer of a much larger dependency graph. A Bitcoin wallet depends upon firmware. Firmware depends upon code. Code depends upon libraries. Libraries depend upon developers. Developers depend upon tools and repositories. Those tools depend upon infrastructure. The entire system depends upon human decisions about what to trust. Water systems operate under the same architecture. So do banks, hospitals, utilities, corporations, and governments.

The complexity of these systems is not inherently bad. Complexity has produced extraordinary increases in productivity, efficiency, connectivity, and human capability. The problem emerges when complexity is mistaken for resilience. A system can be extremely sophisticated and extraordinarily fragile.

AI is now making that distinction more important. If machines can increasingly inspect code, discover vulnerabilities, identify exploitable pathways, impersonate humans, and automate portions of cyber operations, then the amount of time available between vulnerability discovery and exploitation may continue to shrink. The security question becomes less about whether a system has vulnerabilities and more about whether its architecture can withstand the discovery of those vulnerabilities.

That is why the next great divide will not necessarily be between companies that have been hacked and companies that have not. It will be between systems that can absorb compromise and systems that cannot. The first group will experience incidents. The second group will experience failures. The difference between the two may become one of the most important determinants of enterprise value.

For investors, this means cybersecurity should increasingly be treated as a component of fundamental analysis rather than a narrow technology expense. For executives, it means understanding the dependency graph behind the income statement. For policymakers, it means treating software resilience as part of physical infrastructure. For individuals, it means recognizing that diversification must include not only assets, but authentication methods, custodians, communication channels, vendors, and recovery mechanisms.

The future may therefore reward a different kind of efficiency: not the efficiency of eliminating every redundant component, but the efficiency of knowing which redundancies are worth paying for.

In an environment where software vulnerabilities are increasingly discoverable at machine speed, resilience may become one of the most valuable forms of infrastructure humanity can build. The attack surface is no longer merely where infrastructure meets the internet. The attack surface is the infrastructure. And in that environment, the only offense is risk management.

References

Andreina, Sebastien, et al. “Estimating Patch Propagation Times across (Blockchain) Forks.” arXiv, 2022.

AltcoinBuzz. “Coldcard Bitcoin Wallet Exploit and Ongoing Fund Drain.” AltcoinBuzz, Aug. 2026.

Choi, Jusop, et al. “Attack of the Clones: Measuring the Maintainability, Originality and Security of Bitcoin ‘Forks’ in the Wild.” arXiv, 2022.

Coinkite. “COLDCARD Security Advisory and Firmware Guidance.” COLDCARD, July 2026.

Environmental Protection Agency. “Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities.” U.S. Environmental Protection Agency, May 2024.

Environmental Protection Agency. “Report: Management Implication Report: Cybersecurity Concerns Related to Drinking Water Systems.” U.S. Environmental Protection Agency, Office of Inspector General, 13 Nov. 2024.

Environmental Protection Agency. “EPA Actions Help Safeguard Water Systems from Cyberattacks.” U.S. Environmental Protection Agency, 6 Feb. 2026.

Environmental Protection Agency. “EPA, FBI, CISA, NSA Issue Joint Cybersecurity Advisory to Water System Regarding Iranian-Affiliated Cyber Attacks.” U.S. Environmental Protection Agency, 7 Apr. 2026.

Heiding, Fred, et al. “Evaluating AI Models’ Capability to Automate Voice Phishing Attacks.” arXiv, 10 July 2026.

Reuters. “OpenAI Flags Possible Critical Cybersecurity Risk in Upcoming Model, Tightens Controls.” Reuters, 7 Aug. 2026.

TechCrunch. “Hackers Steal over $130M by Exploiting Bug in Offline Hardware Wallets.” TechCrunch, Aug. 2026.

Villa, Corban, Sohee Kim, Austin Chu, Alon Shakevsky, and Raluca Ada Popa. “Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities.” arXiv, 25 June 2026.

World Economic Forum. Global Cybersecurity Outlook 2026. World Economic Forum, 2026.

Wall Street Journal. “The Cyberattack That Brought a Distant War to Small-Town Minnesota.” The Wall Street Journal, 8 Aug. 2026.