What's your take on this moment?

[Myleschetty]

After the incident of Coldcard happened, a group of people which consist of user @Rob1Ham on X ^{(CEO of AnchorWatch)}, @callebtc , @PortlandHODL, @danielabrozzoni, @lylepratt, @stutxo, @benthecarman, @thesimplekid, etc.

Created a team called Bitcoin Red Team, aka Red Team, whose aim was to work endlessly launching a huge wave of reviews on many core Bitcoin projects, especially the crypto libs, wallets, infra, and more.
Checking for critical exploits and vulnerabilities through the use of human effort and AI ^{(like Kimi K3, GPT Sol, Fable, Opus, and GLM5.2)}.

In 27.5 hours, with almost 10k spent in 24hours, and they have reported  

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

Which the ckpool was among the security findings the Red Team detected, and according to @-ck statement, all the possible security holes were swiftly addressed.

At the time of posting this, the Red Team has no website or GitHub repository link.

[Doan9269]

They have done well to have committed themselves to this project, and it is also something to write about, as they have had tremendous success in less than 48 hours of their active work in progress.

To every bitcoin holders, it is time for us to embrace advanced security measures to our wallet and also know the type of wallet to use, coldcard has being a major exposure to many of other related vulnerabilities with some of our wallet we use or knowingly have, having consideration for wallet that supports multisig and the use of a passphrase is necessary for our security if you want to advance.

[CryptoBuds]

Number of false positive here could be much higher. What is more important to me is how many issues are validated by maintainers and how many were actually exploitable, I mean confirmed to have real-world impact.

Another thing I like is that potential vulnerabilities were fixed quickly in the case of ckpool. This means that if coordinated disclosure works properly, open source is stronger. There is no chance of being vulnerable.

It would be even better if Bitcoin Red Team published a public website or GitHub repository. They can show the methodology, verified findings, false positive rate and disclosure timeline there. Just saying 4,962 findings or 85 critical sounds like a big number, it doesn't necessarily mean there are 85 exploitable bugs. It is difficult to judge security posture without context.

[Sunshine1525]

I'm impressed seeing that some people in the Bitcoin community are angered by the recent security bridge on coldcard and took it upon themselves to find loopholes and fix them so more issues won't occur in future but posting it on X alone would raise some doubts on clout chasing to get attentions so it would've been more a site or GitHub was created for more public awareness and verification so i support CryptoBuds opinion concerning that.

Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.