News linked to both this project and an event.
Odaily Odaily News: Bitcoin Red Team, a bitcoin security organization composed of 16 volunteers, stated that it identified nearly 5,000 potential issues during a rapid AI-assisted review of bitcoin ecosystem projects. The organization's members include AnchorWatch CEO Rob Hamilton and bitcoin developer Calle, among others. Calle stated that Bitcoin Red Team used AI tools combined with manual review to scan for vulnerabilities in open-source code repositories related to bitcoin, discovering an average of approximately 1 critical vulnerability per person per hour. Calle disclosed that within 29.8 hours of launch, the team had identified 4,962 potential issues across 390 projects, of which as many as 720 were classified as high-risk or critical. Currently, 21.4% of the findings have been reproduced. The security review initiative was launched just days after the Coldcard hardware wallet vulnerability incident, in which stolen bitcoin exceeded $100 million in value.
Odaily News: Canadian Bitcoin hardware manufacturer Coinkite has warned users of Coldcard Mk3 signing devices to migrate funds from wallets whose seed phrases were generated by affected firmware. Coinkite stated that seed phrases generated by Mk3 firmware version 4.0.1 and later, released in March 2021, may put funds at risk, with the impact extending to version 5.0.3, the final version supporting the Mk3. Coinkite said that Mk4, Q, and Mk5 models are not affected; affected users should generate new seed phrases on unaffected devices, verify backups and receiving addresses, send a small test transaction first, and then migrate the remaining funds. The company said its investigation is still ongoing and that a formal technical review will be published. Bitcoin security experts are examining a centralized transfer of unclear origin involving 594.48 BTC in single-signature addresses, valued at approximately $38.3 million. Rob Hamilton, CEO and co-founder of AnchorWatch, stated that 1,324 unspent transaction outputs were moved via 500 transactions within a three-block window, with 562 BTC subsequently consolidated into another address. Kevin Loaec, CEO of Wizardsardine, said the current hypothesis is that a low-entropy random number generator has caused insufficient randomness in some wallets' seed phrases, with the relevant flaw potentially stemming from a software library, secure element, specific device batch, or firmware version. He added that this hypothesis has not yet been confirmed, and wallets from which only partial funds were transferred may still face the risk of subsequent theft.