What's your take on this moment?

[Myleschetty]

After the incident of Coldcard happened, a group of people which consist of user @Rob1Ham on X ^{(CEO of AnchorWatch)}, @callebtc , @PortlandHODL, @danielabrozzoni, @lylepratt, @stutxo, @benthecarman, @thesimplekid, etc.

Created a team called Bitcoin Red Team, aka Red Team, whose aim was to work endlessly launching a huge wave of reviews on many core Bitcoin projects, especially the crypto libs, wallets, infra, and more.
Checking for critical exploits and vulnerabilities through the use of human effort and AI ^{(like Kimi K3, GPT Sol, Fable, Opus, and GLM5.2)}.

In 27.5 hours, with almost 10k spent in 24hours, and they have reported  

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

Which the ckpool was among the security findings the Red Team detected, and according to @-ck statement, all the possible security holes were swiftly addressed.

At the time of posting this, the Red Team has no website or GitHub repository link.

[Doan9269]

They have done well to have committed themselves to this project, and it is also something to write about, as they have had tremendous success in less than 48 hours of their active work in progress.

To every bitcoin holders, it is time for us to embrace advanced security measures to our wallet and also know the type of wallet to use, coldcard has being a major exposure to many of other related vulnerabilities with some of our wallet we use or knowingly have, having consideration for wallet that supports multisig and the use of a passphrase is necessary for our security if you want to advance.

[CryptoBuds]

Number of false positive here could be much higher. What is more important to me is how many issues are validated by maintainers and how many were actually exploitable, I mean confirmed to have real-world impact.

Another thing I like is that potential vulnerabilities were fixed quickly in the case of ckpool. This means that if coordinated disclosure works properly, open source is stronger. There is no chance of being vulnerable.

It would be even better if Bitcoin Red Team published a public website or GitHub repository. They can show the methodology, verified findings, false positive rate and disclosure timeline there. Just saying 4,962 findings or 85 critical sounds like a big number, it doesn't necessarily mean there are 85 exploitable bugs. It is difficult to judge security posture without context.

[Sunshine1525]

I'm impressed seeing that some people in the Bitcoin community are angered by the recent security bridge on coldcard and took it upon themselves to find loopholes and fix them so more issues won't occur in future but posting it on X alone would raise some doubts on clout chasing to get attentions so it would've been more a site or GitHub was created for more public awareness and verification so i support CryptoBuds opinion concerning that.

Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.

[Lida93]

Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.

It's as fast as it could be, a good programmer can be as fast as any hacker, their difference is in the intentions. I expect this progress would to an extend bring about a sigh of relief for many bitcoin holders out there reading about it.

It doesn't seem to be a sponsored project but a volunteering one, perhaps from how successful their mission gets we might then be seeing voluntary donors in support of their course.

[AmoreJaz]

They have done well to have committed themselves to this project, and it is also something to write about, as they have had tremendous success in less than 48 hours of their active work in progress.

To every bitcoin holders, it is time for us to embrace advanced security measures to our wallet and also know the type of wallet to use, coldcard has being a major exposure to many of other related vulnerabilities with some of our wallet we use or knowingly have, having consideration for wallet that supports multisig and the use of a passphrase is necessary for our security if you want to advance.

If you are dealing with significant amount of investment, you really need to secure your privacy and other matters related to it.

[PrivacyG]

Open source and particularly Bitcoin is very interesting, is it not.  You get an exchange hacked and people start realizing they should care how secure the platform they are using is.  You get a hardware wallet vulnerability and a group of people who spend thousands of Dollars checking for vulnerabilities forms.  It is extremely unfortunate that the Coldcard incident happened but we could say this is a positive side of the story.

On the other hand.  Thousands of vulnerabilities being reported and fixed means more bugs in the code as there is no such thing as code with no bugs.  So this is going to be an 'infinite' fight for perfect security.  And now that the Coldcard compromise existed, there will definitely be more 'sharks' with a list of wallets waiting for the newest updates of them to check vulnerabilities with 'AI'.  I do not know what to think of this, these are dubious times we are living in!

[Cleanshit]

Open source and particularly Bitcoin is very interesting, is it not.  You get an exchange hacked and people start realizing they should care how secure the platform they are using is.  You get a hardware wallet vulnerability and a group of people who spend thousands of Dollars checking for vulnerabilities forms.  It is extremely unfortunate that the Coldcard incident happened but we could say this is a positive side of the story.

On the other hand.  Thousands of vulnerabilities being reported and fixed means more bugs in the code as there is no such thing as code with no bugs.  So this is going to be an 'infinite' fight for perfect security.  And now that the Coldcard compromise existed, there will definitely be more 'sharks' with a list of wallets waiting for the newest updates of them to check vulnerabilities with 'AI'.  I do not know what to think of this, these are dubious times we are living in!

This an advantage of an open source software Coldcard incident wasn’t a good one but this encourages users to review related Bitcoin projects for security problems. To find and fix bug shouldn’t raise alarm but it should be  an ongoing process. And also numbers of reported vulnerabilities it not really the most important, what really matters is how quickly developer fix them and also how many are being confirm . Responsible disclosure with fast responds has made Bitcoin project more secure for all.

[macson]

Their efforts deserve great appreciation because they worked so diligently to uncover all those security vulnerabilities across so many Bitcoin projects. Although this was only done after the unfortunate Coldcard incident, at least they succeeded in identifying the security vulnerabilities, and the projects have since addressed them --- which has been a huge help to those projects and to so many users.

[Vaskiy]

Their efforts deserve great appreciation because they worked so diligently to uncover all those security vulnerabilities across so many Bitcoin projects. Although this was only done after the unfortunate Coldcard incident, at least they succeeded in identifying the security vulnerabilities, and the projects have since addressed them --- which has been a huge help to those projects and to so many users.

Very few with technical understanding about the issues involve themselves into finding a solution. Forming a team and working towards the betterment in security needs to be appreciated. As said in a previous post it is an indication, further we need to keep improving and it is going to be a continued process. We've got AI and more advancement which will be used for positive as well as negative way. One will be keep rectifying the security and the other side another will be finding loopholes to breach security. So, what the team have begun is a long term process and even in 48 hours the findings were huge.

[jossiel]

It's great to see them team up and do it for that sake. I've read that one of those who's done a lot in the community through x's post, zachxbt has been tired of doing all of these work just for nothing and for free.

So, if these people have got the resources and won't be feeling the same as he, then this is going to be a big help to the world in specific especially for the non tech folks.

[BlackBoss_]

In 27.5 hours, with almost 10k spent in 24hours, and they have reported  

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

I don't know how these security issues reported because if hackers know about these issues, they can take advantage of it and exploit those platforms. Not all companies are fast with fixing security issues while nowadays with AI support, hackers can do their dark jobs very quickly and efficiently.

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

When people from developers, researchers, and normal users put many data into AIs, it will come to an explosion point when such data leaked and caused massive exploitation.

[joniboini]

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

I mean the only way your data won't be feed into AI is to never publish it on the internet. I don't think that's possible for open source projects though. It must be verifiable, which means everyone should be able to see and test it themselves. If someone has malicious intent in the first place, I don't think you can stop them without affecting legitimate users. I'm sure people will adapt. It's not like AI or language model is exlusive to scammers to begin with.

[shinratensei_]

In 27.5 hours, with almost 10k spent in 24hours, and they have reported 

1 4,962 security findings
2 85 critical vulnerabilities
3 635 high-severity vulnerabilities

I don't know how these security issues reported because if hackers know about these issues, they can take advantage of it and exploit those platforms. Not all companies are fast with fixing security issues while nowadays with AI support, hackers can do their dark jobs very quickly and efficiently.

I also highly concern about data input for AIs, how will these data not leaked to hackers, even as data not security reports. I feel AI like a very huge threat for privacy, anonymity, security, and more. It seems the human civilization has been going to a new era with many modern threats that have AI factors.

When people from developers, researchers, and normal users put many data into AIs, it will come to an explosion point when such data leaked and caused massive exploitation.

They probably reported privately first and local PoC. Security researchers don't simply do a public dump to their finding otherwise it'll only make things worse.
AI also don't train on those conversation right off the bat and they usually filtered it for the supervised fine tuning. Some AI provider also allow for zero data retention inferences.

[Peanutswar]

[...]
Although it's amazing how fast they were able to discover and address the loopholes but I'm curious to who sponsored the task or project rather, was it voluntary from the names you mentioned or someone anonymous? However the bottomline is that the 85 critical can't be fully trusted until a verified report is given.

If you have a background in software development and cyber security and penetration is possible you can see the vulnerability to the system and just having a brief background regarding with the cold card is they didn't even notice this vulnerability at all and just one mistake the hackers already understand what are the weakness of the system and because of the small number of combination they easily manage to stole tons number of bitcoins with the help of the AI you can now generate a fast random words in an instant reason why we have this kind of big news previously. Also with the huge value of the bitcoin and its current price no wonder why this kind of attack is no doubt be planned

[davis196]

What's my take on this moment? Do you expect me(or us) to criticize it? Everyone in the community would appreciate and support all the efforts made by the Bitcoin developers towards finding and solving vulnerabilities across the crypto industry. I don't know about anyone, who would come up with a negative statement about this Bitcoin Red Team. I can assume that the ColdCard hack did something good for the community. It forced the BTC developers to wake up and start improving the overall security of the crypto world. Utilizing AI for this task is a must, because AI can speed things up a lot.

[pooya87]

Ever since "open source" became a thing, people who were capable of reading code have been contributing to these open source projects, helping them find bugs, make improvements, add new features, and so on. So what these people are doing is nothing new.

This is fantastic thing they are doing though and more people should join and review code however they can and contribute to their favorite open source projects.

[bitLeap]

They probably reported privately first and local PoC. Security researchers don't simply do a public dump to their finding otherwise it'll only make things worse.
AI also don't train on those conversation right off the bat and they usually filtered it for the supervised fine tuning. Some AI provider also allow for zero data retention inferences.

It should be like that, reporting to the relevant parties rather than quickly posting on the internet to get attention, the risk is too great. Especially for high-level vulnerabilities means hackers can first exploit before being fixed. It is not easy to publish such an important and valuable finding if it is ultimately overlaid.

[Outhue]

I am highly disappointed in every crypto companies out there, like AI is everywhere now, what are they doing that these people are the ones coming together to form a team? The likes of Red team should be the ones creating open source hardware wallet, because that's are ready to find every vulnerability possible.

This get together is something that Ledger and others should form themselves, hardware wallet companies should be the ones doing this, why are third parties coming together to clean the mess of people who are supposed to protect against vulnerabilities in crypto space? I don't get it.

[Catenaccio]

Ever since "open source" became a thing, people who were capable of reading code have been contributing to these open source projects, helping them find bugs, make improvements, add new features, and so on. So what these people are doing is nothing new.

This is fantastic thing they are doing though and more people should join and review code however they can and contribute to their favorite open source projects.

People who are incapable of reading code, find bugs and backdoors always have to rely on the others to know which wallets are secure and good to use. At least, but very important, open source projects, open source wallets allow many people who are capable of doing these things to verify the source code, security, and it gives more technical-based reliable reviews for community.

Because if someone made a bad review while there are bugs or backdoors in a wallet, there will be other people who are able to discover these things and report them to community.

Open source wallets are not always better than close source wallets but because of above reasons, I always prioritize open source wallets.