It's a good movement, is all I can say, because there is basically no incentives involved and they are doing this voluntarily only for the betterment of the community and this industry, unless they have ulterior motives hidden from the general public, but we shouldn't think negative about such positive things.

After the recent coldcard attack, the community must have learned one thing: always use systems, such as hardware or anything like that, only if it has open-source software that can be publicly verified by anyone with knowledge about it. When something is open-source, it can be checked by other developers who aren't a part of the project and won't pass biased judgements, this will allow people to have more trust in the projects and also be safer when it comes to their financial holdings.

People will also learn to use passphrases on their wallets from now on, because this attacked has proved that just keeping your seed phrase safe is not enough because you never know, your seed phrase might have reached someone else before it reached you after it was created.

With users, not all users have to review the code because they are not capable for it. If all users have to check the code before using Bitcoin blockchain, Bitcoin wallets, I am sure Bitcoin already failed. Fortunately, code checking can be done by community members and there are many people are technical capable to do that, then publish their reviews.

Additionally, reviews will be reviewed by the other people too, so it's how a project with open source code can be considered as reliable and quality if code has been reviewed by many people.

This discussion will now spill over to open source Vs closed source, if coldcard had run their business on an open source platform whatever vulnerability that was recently exploited would have been found and the hack would have been avoided!!

But following all the chatter about this incident , some people are saying this could have been an inside job because they themselves made a joke about this entropy generation bug back in 2021.. and 5years later boom hacked by the the very  "entropy generation bug" talk about coincidence!


Credit: cyber scrilla

-------

Goodluck to Bitcoin Red Team, hunting season is on

Honestly, I think this is probably the best response that the Bitcoin community could have had after the whole Coldcard incident.

AI has helped to speed up the process, but it was still humans that verified the findings and pushed for fixes.
Of course incidents like this cause a lot of damages but the real strength of an open source software is that bugs can be independently scrutinized, disclosed and fixed rather leaving it unaddressed.

So if bugs can now be found faster and all these bitcoin related software projects are forced to take security more seriously, then that’s definitely a good thing for the entire bitcoin ecosystem.

Ugly scenarios called for urgent attention; that's how it should be. We can't be calm to watch what has happened to Coldcard repeat again. The crypto space will not be a level playing ground for scammers and hackers to get into and move away with people's funds at any time.

I want to commend those who have come together to build a team called Bitcoin Red Team. At least they are standing in the gap to fill the security holes for Bitcoin core projects not be hacked because of their vulnerabilities

This is really scary that the team found so many vulnerabilities, but it is good that they found not hackers and they fixed all of them. Another thread mentioned that the OP said Red Team was behind the vulnerability detection in BTCPay Server, so that was one of them. But they spent so little time and found vulnerabilities that would have taken months or maybe a year if done manually, and yet we still think AI is not helping.

They used all kinds of models, and they definitely know what they are doing. I am surprised to see the kind of work they have done. They should be rewarded, but is there any list of all the projects where they found these vulnerabilities? Vik Sharma donated $10k, that's amazing.

So Kimi K3 gave them uncensored access to their models. Well, that's something new. I did not know models could offer such services on demand. Maybe they had some deal or something, but whatever it was, it seems it was possible due to such uncensored models because models have a lot of restrictions.

Well, most vulnerability disclosure guideline always recommend to report privately first but give a deadline until 30-90 days, if there is no response from the organization to provide patch, then you're allowed to do public disclosure to pressure them to fix what needed to be fixed.

The problem is, while some organization genuinely appreciate the report and give reward, other don't have the money and may not have a time to maintain their open source tools, some other simply don't care which is why there has been discourse about security researchers and some big corpos about the security findings and researcher decided to dump the PoC to public.

If you are in IT, you can try to review code but with me, I am not in IT and I will not spend my time to learn about programming just to review codes of Bitcoin wallet soft wares, firm wares before I use them.

As I talked about it in my previous post, if code reviewing is a mandatory task to do before using Bitcoin, it's a very big barrier prevents Bitcoin from many people. The majority do not know about IT, don't know about programming, can not review codes, and such barrier will only keep them away from Bitcoin.

It's more fearful if there are security issues reported by community, from reviews or reports, but the company teams ignore all. It's what Coldcard team did since years ago and the hack is only a consequence of their security ignorance even they got support from community.

Op says all possible security holes were swiftly addressed. I assumed that to mean the vulnerabilities identified has been fixed accordingly. Some companies delay update even after several reports of bugs but definitely not this time. Deliberately delaying to fix the bugs after the report will affect the company reputation. If anything happens after that, the company will solely be blamed for not taking swift action even after recommendations and consequently lost public confidence. One problem with this is hackers might still try to look for more vulnerability after this report.