Bitcoin Red Team uncovers nearly 5,000 potential vulnerabilities across 390 crypto projects, including severe risks linked to Coldcard wallets.
The Bitcoin Red Team, a volunteer collective, has reported discovering 4,962 potential security flaws across 390 Bitcoin-related projects. Among these vulnerabilities, 85 were categorized as critical and 635 as high severity.
In the initial phase of their extensive audit, which lasted approximately 29.8 hours, the team verified 21.4% of their findings, while the remainder awaits confirmation. This audit stems from security breaches affecting Coldcard hardware wallets that resulted in over $100 million in losses.
Audit Overview
Comprising 16 globally distributed experts, including developers and security professionals, the Bitcoin Red Team is scrutinizing cryptographic libraries, wallet applications, and various open-source projects. They leverage both AI and manual analyses, employing specialized tools to identify and simulate vulnerabilities in a secure environment.
According to team member Calle, they typically discover about one critical exploit for every team member each hour, although he did not elaborate on their specific methodologies.
"We've been reaching out to many folks. Most critical reports have been quickly verified by project owners, indicating we're targeting significant issues," Calle stated.
While the team has maintained discretion regarding the specific projects under scrutiny, Calle emphasized that critical findings are verified through practical attack simulations before being communicated to developers privately.
Reasons for the Audit
This initiative arose in response to the vulnerabilities exploited in Coldcard devices, as reported by Galaxy Research. At least 15 distinct attackers capitalized on a flaw, leading to losses estimated at $100 million, with a potential fourth wave possibly increasing that figure to around $130 million.
Coinkite, the manufacturer of Coldcard wallets, explained that the issue stemmed from firmware updates made in 2021, where some devices relied on a flawed software random number generator instead of a secure hardware alternative. Subsequent analyses suggested that the effective entropy for some devices was severely compromised.
Challenges and AI Utilization
Rob Hamilton, the team leader, noted that while identifying vulnerabilities is key, effectively communicating these findings to the developers poses a significant challenge. The initiative has incurred expenses near $20,000, and funding is secured for their ongoing efforts.
"The most difficult aspect is coordinating to relay information to the right people," Hamilton remarked.
Previously, the AI model Claude from Anthropic identified several vulnerabilities in the Firefox browser, showing the growing intersection of AI in security assessments. This audit could indicate a shift in how the cryptocurrency sector approaches vulnerability management, especially amidst rising concerns about security within the ecosystem.
