Bitcoin Red Team and dami ng nakitang vulnerabilities gamit ang AI

[fullfitlarry]

Dahil sa insidente sa Coldcard hack nagkaroon ng volunteer security initiative at ito ay tinawag na Bitcoin Red Team.

Sa ngayon sila ay nakakita na ng:

We scanned 501 projects and produced 7,958 findings, of which 1,280 are rated high or critical (H+C) severity.

https://x.com/callebtc/status/2086220411084103707

Napaka gandang inisyatibo to at mukhang parami ng parami ang ang volunteer around the clock na tingnan lahat ang wallets, infrastructure at libraries. Ang ginamit nila ay Ang Kimi K3,  OpenAI's GPT Sol, Anthropic's Claude Fable at Opus models, at Z.ai's GLM 5.2, upang hanapin ang mga kahinaan at makabuo ng mga sumusuportang dokumentasyon.

[Ziskinberg]

So they are using AI pala. I think that is good since the process can be automated and they can scan more projects faster.

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

For me, the important part is still the verification after the AI finds something.

[SatsPH]

So they are using AI pala. I think that is good since the process can be automated and they can scan more projects faster.

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

For me, the important part is still the verification after the AI finds something.

Bitcoin news reports that security researcher Rob Hamilton of the Bitcoin Red Team had to switch to Chinese open-source AI models after losing access to OpenAI’s Trusted Access for Cyber tools. The team, which has already found nearly 5,000 potential security issues in 29.8 hours, relies on AI to prioritize code reviews. Hamilton claims the restrictions hurt defenders more than attackers. The Coldcard exploit in July, which stole 1,816 BTC, has made security a top priority. Altcoins to watch may also face similar risks if AI tools remain limited.

https://www.kucoin.com/news/flash/bitcoin-security-researchers-turn-to-chinese-ai-after-openai-restrictions

Gumagamit na din sila ng Chinese AI para maghanap ng vulnerabilities. So ang AI talaga sa ngayon at double edge standard. Pwede mong gamitin sa masama katulad sa Coldcard o gamitin sa mabuti katulad ng ginagawa ng Bitcoin Red team.

Sa findings naman sa tingin ko ibibigay nila to sa mga projects na nakitaan nila ng vulnerabilities at sila na ang mag access at syempre kung hindi ito false positive ay dapat nila i-patch na agad.

[julerz12]

~snip~

This is great. Prevention is always better than cure. Mas maigi na ma-audit lahat ng Bitcoin-related projects and platforms para hindi na maulit pa ang mga recent attacks and exploits.
BTW, if anybody here is willing to donate to their cause, you can do it here: https://opensats.org/funds/red

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

Verification is done by the members of that team; yung AI parang force multipliers lang. It helps them rapidly scan files, then when the AI flags something on the code, members of the Bitcoin Red Team verify it. They also check if the findings are false positives or not. From what I've read, they also share their findings with project owners/devs.

[lionheart78]

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

Verification is done by the members of that team; yung AI parang force multipliers lang. It helps them rapidly scan files, then when the AI flags something on the code, members of the Bitcoin Red Team verify it. They also check if the findings are false positives or not. From what I've read, they also share their findings with project owners/devs.

Yeah, I also think na ang Bitcoin Red Team ay gumagamit ang AI to flag possible vulnerabilities then icheck nila by running test kung ang finding ay totoo.  It would be very irresponsible of this team if they fully rely on AI at kapag natag ng  AI ay iannounce na agad without verifying them.

Ang ganda nito, maraming mga projects ang makikinabang sa inisyatibo ng Bitcoin Red Team, dahil maiiiwasan nila ang mga possible exploits dahil nadetect na ito agad bago pa man matuklsan ng mga taong may masamang intention.