What's your take on this moment?

[Myleschetty]

After the incident of Coldcard happened, a group of people which consist of user @Rob1Ham on X ^{(CEO of AnchorWatch)}, @callebtc , @PortlandHODL, @danielabrozzoni, @lylepratt, @stutxo, @benthecarman, @thesimplekid, etc.

Created a team called Bitcoin Red Team, aka Red Team, whose aim was to work endlessly launching a huge wave of reviews on many core Bitcoin projects, especially the crypto libs, wallets, infra, and more.
Checking for critical exploits and vulnerabilities through the use of human effort and AI ^{(like Kimi K3, GPT Sol, Fable, Opus, and GLM5.2)}.

In 27.5 hours, with almost 10k spent in 24hours, and they have reported  

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

Which the ckpool was among the security findings the Red Team detected, and according to @-ck statement, all the possible security holes were swiftly addressed.

At the time of posting this, the Red Team has no website or GitHub repository link.

[Doan9269]

They have done well to have committed themselves to this project, and it is also something to write about, as they have had tremendous success in less than 48 hours of their active work in progress.

To every bitcoin holders, it is time for us to embrace advanced security measures to our wallet and also know the type of wallet to use, coldcard has being a major exposure to many of other related vulnerabilities with some of our wallet we use or knowingly have, having consideration for wallet that supports multisig and the use of a passphrase is necessary for our security if you want to advance.

[CryptoBuds]

Number of false positive here could be much higher. What is more important to me is how many issues are validated by maintainers and how many were actually exploitable, I mean confirmed to have real-world impact.

Another thing I like is that potential vulnerabilities were fixed quickly in the case of ckpool. This means that if coordinated disclosure works properly, open source is stronger. There is no chance of being vulnerable.

It would be even better if Bitcoin Red Team published a public website or GitHub repository. They can show the methodology, verified findings, false positive rate and disclosure timeline there. Just saying 4,962 findings or 85 critical sounds like a big number, it doesn't necessarily mean there are 85 exploitable bugs. It is difficult to judge security posture without context.

[Sunshine1525]

I'm impressed seeing that some people in the Bitcoin community are angered by the recent security bridge on coldcard and took it upon themselves to find loopholes and fix them so more issues won't occur in future but posting it on X alone would raise some doubts on clout chasing to get attentions so it would've been more a site or GitHub was created for more public awareness and verification so i support CryptoBuds opinion concerning that.

Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.

[Lida93]

Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.

It's as fast as it could be, a good programmer can be as fast as any hacker, their difference is in the intentions. I expect this progress would to an extend bring about a sigh of relief for many bitcoin holders out there reading about it.

It doesn't seem to be a sponsored project but a volunteering one, perhaps from how successful their mission gets we might then be seeing voluntary donors in support of their course.

[AmoreJaz]

They have done well to have committed themselves to this project, and it is also something to write about, as they have had tremendous success in less than 48 hours of their active work in progress.

To every bitcoin holders, it is time for us to embrace advanced security measures to our wallet and also know the type of wallet to use, coldcard has being a major exposure to many of other related vulnerabilities with some of our wallet we use or knowingly have, having consideration for wallet that supports multisig and the use of a passphrase is necessary for our security if you want to advance.

If you are dealing with significant amount of investment, you really need to secure your privacy and other matters related to it.

[PrivacyG]

Open source and particularly Bitcoin is very interesting, is it not.  You get an exchange hacked and people start realizing they should care how secure the platform they are using is.  You get a hardware wallet vulnerability and a group of people who spend thousands of Dollars checking for vulnerabilities forms.  It is extremely unfortunate that the Coldcard incident happened but we could say this is a positive side of the story.

On the other hand.  Thousands of vulnerabilities being reported and fixed means more bugs in the code as there is no such thing as code with no bugs.  So this is going to be an 'infinite' fight for perfect security.  And now that the Coldcard compromise existed, there will definitely be more 'sharks' with a list of wallets waiting for the newest updates of them to check vulnerabilities with 'AI'.  I do not know what to think of this, these are dubious times we are living in!

[Cleanshit]

Open source and particularly Bitcoin is very interesting, is it not.  You get an exchange hacked and people start realizing they should care how secure the platform they are using is.  You get a hardware wallet vulnerability and a group of people who spend thousands of Dollars checking for vulnerabilities forms.  It is extremely unfortunate that the Coldcard incident happened but we could say this is a positive side of the story.

On the other hand.  Thousands of vulnerabilities being reported and fixed means more bugs in the code as there is no such thing as code with no bugs.  So this is going to be an 'infinite' fight for perfect security.  And now that the Coldcard compromise existed, there will definitely be more 'sharks' with a list of wallets waiting for the newest updates of them to check vulnerabilities with 'AI'.  I do not know what to think of this, these are dubious times we are living in!

This an advantage of an open source software Coldcard incident wasn’t a good one but this encourages users to review related Bitcoin projects for security problems. To find and fix bug shouldn’t raise alarm but it should be  an ongoing process. And also numbers of reported vulnerabilities it not really the most important, what really matters is how quickly developer fix them and also how many are being confirm . Responsible disclosure with fast responds has made Bitcoin project more secure for all.

[macson]

Their efforts deserve great appreciation because they worked so diligently to uncover all those security vulnerabilities across so many Bitcoin projects. Although this was only done after the unfortunate Coldcard incident, at least they succeeded in identifying the security vulnerabilities, and the projects have since addressed them --- which has been a huge help to those projects and to so many users.

[Vaskiy]

Their efforts deserve great appreciation because they worked so diligently to uncover all those security vulnerabilities across so many Bitcoin projects. Although this was only done after the unfortunate Coldcard incident, at least they succeeded in identifying the security vulnerabilities, and the projects have since addressed them --- which has been a huge help to those projects and to so many users.

Very few with technical understanding about the issues involve themselves into finding a solution. Forming a team and working towards the betterment in security needs to be appreciated. As said in a previous post it is an indication, further we need to keep improving and it is going to be a continued process. We've got AI and more advancement which will be used for positive as well as negative way. One will be keep rectifying the security and the other side another will be finding loopholes to breach security. So, what the team have begun is a long term process and even in 48 hours the findings were huge.

[jossiel]

It's great to see them team up and do it for that sake. I've read that one of those who's done a lot in the community through x's post, zachxbt has been tired of doing all of these work just for nothing and for free.

So, if these people have got the resources and won't be feeling the same as he, then this is going to be a big help to the world in specific especially for the non tech folks.

[BlackBoss_]

In 27.5 hours, with almost 10k spent in 24hours, and they have reported  

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

I don't know how these security issues reported because if hackers know about these issues, they can take advantage of it and exploit those platforms. Not all companies are fast with fixing security issues while nowadays with AI support, hackers can do their dark jobs very quickly and efficiently.

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

When people from developers, researchers, and normal users put many data into AIs, it will come to an explosion point when such data leaked and caused massive exploitation.

[joniboini]

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

I mean the only way your data won't be feed into AI is to never publish it on the internet. I don't think that's possible for open source projects though. It must be verifiable, which means everyone should be able to see and test it themselves. If someone has malicious intent in the first place, I don't think you can stop them without affecting legitimate users. I'm sure people will adapt. It's not like AI or language model is exlusive to scammers to begin with.

[shinratensei_]

In 27.5 hours, with almost 10k spent in 24hours, and they have reported 

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

I don't know how these security issues reported because if hackers know about these issues, they can take advantage of it and exploit those platforms. Not all companies are fast with fixing security issues while nowadays with AI support, hackers can do their dark jobs very quickly and efficiently.

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

When people from developers, researchers, and normal users put many data into AIs, it will come to an explosion point when such data leaked and caused massive exploitation.

They probably reported privately first and local PoC. Security researchers don't simply do a public dump to their finding otherwise it'll only make things worse.
AI also don't train on those conversation right off the bat and they usually filtered it for the supervised fine tuning. Some AI provider also allow for zero data retention inferences.