vulnerabilities

Bitcoin News posted on the X platform that after two weeks of using cutting-edge AI to scan almost the entire Bitcoin open-source ecosystem for vulnerabilities, Bitcoin Red Team member @callebtc stated, "The easily discoverable vulnerabilities have been addressed," and maintainers are verifying "a large number" of serious and high-risk vulnerabilities.@callebtc indicated that the main findings include: decades of accumulated open-source technical debt are being exposed alongside AI capabilities that can discover vulnerabilities at speeds and scales unattainable by human researchers; Lightning seems particularly vulnerable, with its complexity meaning its security status is "worse than average"; unmaintained Bitcoin projects should be considered vulnerable until their security is confirmed.Projects that began building AI security and auditing processes months ago are now in a completely different position compared to those that have been waiting until now. The Bitcoin Red Team has now completed a foundational scan of almost the entire Bitcoin open-source ecosystem. Easily discoverable vulnerabilities have mostly been addressed, but as AI capabilities improve, external red team testing may need to continue indefinitely. Despite discovering and reporting "a large number" of real serious and high-risk vulnerabilities, @callebtc believes this process will ultimately make Bitcoin stronger. The same AI security review will soon expand to areas far beyond Bitcoin.

The Bitcoin wallet Electrum has released version 4.8.1, with the official statement claiming that this update includes "important security fixes" and urging users to upgrade as soon as possible.Developers involved in reproducible builds have provided independent signatures for the binary packages on the download page to verify the consistency between the release package and the source code.

According to Forbes, the scale of the theft in the Coldcard hardware wallet vulnerability incident has risen to approximately $130 million, involving about 2,000 BTC and over 5,200 addresses, reigniting the industry's debate over who should hold private keys. Data from Bitcoin Magazine shows that in the days following the incident, the net inflow into U.S. spot Bitcoin ETFs was $626 million, with some opinions suggesting that the vulnerability may drive more funds towards ETFs.Reports indicate that supporters of self-custody remain undeterred. Casa co-founder Jameson Lopp stated that confidence in self-custody should not be lost due to recent events, as custodial institutions also rely on random number generators. Bitcoin core early developer Peter Todd noted that the historical record of self-custody is far better than that of third parties. Another viewpoint argues that both reflexive choices have flaws. Onramp co-founder Michael Tanguma stated that if the only answer is Coinbase or ETFs, it poses a serious problem, as centralizing what should be decentralized assets undermines their foundation, advocating for a multi-institutional custody solution where keys are held by multiple regulated entities.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Decrypt, a volunteer security team stated that it scanned 150 Bitcoin code repositories using cutting-edge artificial intelligence models and discovered a dozen vulnerabilities. The team has built multiple AI-based review systems, targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. Team members claim that, on average, each person can find about one serious vulnerability per hour, and in the past 12 hours, they have submitted security reports to multiple projects, but specific affected projects have not yet been made public.

The Bitcoin Red Team's volunteer security initiative has scanned approximately 150 Bitcoin code repositories and disclosed more than a dozen vulnerabilities. The team is developing an open-source AI platform for auditing Bitcoin software, covering wallets, cryptographic libraries, infrastructure, and other projects.AnchorWatch CEO Rob Hamilton stated that the team has currently spent about $20,000 on various AI services and is using Kimi K3, OpenAI's GPT Sol, Anthropic's Claude Fable and Opus, as well as Z.ai's GLM 5.2 to identify vulnerabilities and generate related documentation. A pseudonymous Bitcoin developer, Calle, mentioned that the team has reported critical vulnerabilities to multiple projects in the past 12 hours, averaging about one critical vulnerability discovered per person per hour, with daily expenditures of approximately $10,000. The team did not disclose the affected projects or details of the vulnerabilities.

According to TechCrunch, OpenAI is fighting back against Apple's lawsuit regarding the leak of trade secrets, stating that Apple itself has vulnerabilities in its information security management and employee departure processes, and cannot prove that the relevant information is protected trade secrets.Apple previously accused OpenAI of obtaining hardware-related secrets through former employees who left Apple and requested the court to expedite the evidence investigation. In the latest legal documents submitted, OpenAI stated that Apple allows employees to use personal iCloud accounts to handle work materials and did not promptly revoke access after employees left. OpenAI claimed that Apple did not specify the exact trade secrets that were allegedly stolen, but only referred generally to information such as product development processes, supply chains, and testing.OpenAI believes that Apple's lawsuit is more about restricting its development in the AI hardware field and denies that the company needs or uses Apple's trade secrets. The focus of the dispute between the two parties centers on employee mobility, intellectual property protection, and competition in the AI hardware sector.

Bitcoin News posted on the X platform that the volunteer organization Bitcoin Red Team has scanned 150 code repositories, privately disclosed more than a dozen vulnerabilities, and identified key issues during the process of strengthening wallets, cryptographic libraries, and infrastructure following the COLDCARD vulnerability incident. This work has consumed approximately $20,000 in AI computing costs, covered by OpenSats.Researchers are using multiple AI tools, with many stating that open-source models like Kimi K3 have become primary tools for security research, while cutting-edge closed-source models like OpenAI and Anthropic are considered to impose more limitations in such analyses. The team plans to open-source its AI security tools to enable projects to continuously audit their own codebases. Researchers warn that Bitcoin may just be the first industry facing a wave of AI-assisted vulnerability discovery, with similar efforts likely to expand to all open-source software.

Bitcoin News posted on the X platform stating that Coinkite claims the vulnerability exists at the boundaries of two unrelated firmware submodules, rather than in its Bitcoin or crypto code, allowing it to evade manual and AI-assisted code reviews for years.Coinkite stated that after the incident, the company tested cutting-edge AI models including Kimi K3, Claude Fable, and Codex 5.6, none of which identified the flaw. Coinkite is currently urging security-critical projects to specifically audit build systems and submodule boundaries, warning that AI-assisted development may leave similar blind spots in the Bitcoin ecosystem.

Binance founder Zhao Changpeng reposted on the X platform about a user being attacked by a Coldcard wallet and stated that software will always have vulnerabilities; the key is how the team behind it addresses the issues.Zhao Changpeng added that Trust Wallet also faced a similar problem years ago, where the use of a non-truly random pseudorandom number generator led to a loss of about 12 million dollars, but the team ultimately covered the users' losses.Previously, a suspected third wave of attacks targeting Coldcard-generated addresses has emerged, with attackers again transferring about 207.7294 BTC. Data shows that the scale of observed Coldcard-related attacks has expanded to about 1,367.05 BTC, involving approximately 4,585 addresses, valued at about 88.6 million dollars at current prices.

Zhao Changpeng posted on platform X, stating that regarding the suspected vulnerability of the Coldcard wallet that led to over $38 million in Bitcoin being stolen, even hardware wallets may have vulnerabilities.Even long-established wallets may have vulnerabilities. To reduce risk, one might consider diversifying funds across several wallets, but this brings another set of risks. Nothing is 100% secure.

Anthropic announced that the Claude Mythos Preview model has made breakthroughs in cryptographic research, discovering improved attack methods against the post-quantum digital signature candidate HAWK. HAWK is a post-quantum signature candidate solicited by NIST to combat quantum computer attacks, which has already passed two rounds of expert review. However, Claude reduced the effective key strength of HAWK-256 from 2^64 to 2^38 in just 60 hours, significantly lowering the theoretical cost of cracking. HAWK has not yet been deployed in practice, and this attack currently does not affect any production systems.Claude also discovered an improved attack against 7-round AES, achieving a speed increase of 200 to 800 times. During the research process, Claude independently completed literature reviews, mathematical reasoning, and experimental validation with limited guidance from cryptographers. The HAWK attack took about 60 hours and had an API cost of approximately $100,000; the AES attack was completed independently by Claude, which generated about 1 billion tokens before proposing core innovative ideas. Anthropic researchers then spent hundreds of hours validating the results. Anthropic stated that AI models can now help identify significant flaws in cryptographic algorithms, and the cryptography community may face bottlenecks similar to those in the software vulnerability field—AI-generated research results far exceed human verification capabilities. Anthropic has collaborated with academic institutions to launch the CryptanalysisBench benchmark and coordinated disclosures with NIST authors and government partners. The research team has achieved preliminary results on algorithms such as LEA and Serpent-128. Anthropic warns that as AI capabilities improve, actual attacks against deployed systems may be discovered in the future, necessitating the establishment of response mechanisms in advance.

According to Bitcoin News, the latest Senate draft of the CLARITY Act includes a provision that encourages ethical hackers, specifically "white hat" hackers, to responsibly disclose cybersecurity vulnerabilities. The proposal would authorize rewards for individuals who identify and report security flaws, aiming to enhance the protection of digital asset infrastructure before malicious actors exploit these vulnerabilities. This provision incorporates the views of former CFTC Chairman J. Christopher Giancarlo, who has long supported innovation in digital assets and market resilience.

The founder of Slow Fog, Yu Xian, retweeted a tweet on the X platform regarding the potential poisoning attack risks of Claude Code and published an analysis of the poisoning attack details targeting Grok Build CLI and Claude Code CLI.It pointed out that the security mechanisms of Grok Build CLI are not unified, with different code paths having different trust assumptions, creating gaps that serve as channels for attackers. Attackers may execute arbitrary commands through malicious project configuration files without the user's knowledge, thereby stealing API keys, cloud credentials, or controlling local devices.Researchers constructed a testing environment and found that on Mac systems, if Claude Code is affected, executing specific test commands can trigger the local calculator to launch, proving the existence of potential command execution risks.If the attack is successful, attackers may further steal API keys from AI services like Claude and OpenAI, resulting in account cost losses, gain access to servers and data by obtaining cloud service credentials from AWS, Alibaba Cloud, Tencent Cloud, modify code repositories to implant backdoors, and use local devices as jump points to attack corporate internal networks. It is reported that the related vulnerabilities have existed for a year.

According to CoinDesk, the Ethereum Foundation recently disclosed that its security team used AI agents to test the software running on Ethereum validator nodes and successfully discovered a remotely triggerable vulnerability that could cause node crashes. However, researchers emphasized that human review remains a key step in distinguishing real vulnerabilities from false positives among the large number of security reports generated by AI.It is reported that the discovered vulnerability exists in the Ethereum network message propagation protocol gossipsub, where an attacker can remotely trigger the node software to enter an abnormal computation state, causing the program to crash and shut down, making the validator node go offline until the operator manually restarts it. This vulnerability has been fixed and registered under the identifier "CVE-2026-34219."Nikos Baxevanis, a member of the Ethereum Foundation's protocol security team, stated that what was truly surprising about this incident was not the AI's ability to discover vulnerabilities, but rather the amount of time the team spent discerning which vulnerabilities were real and which were merely seemingly credible "illusions."

The Ethereum Foundation Protocol Security team researchers stated in a blog post on Thursday that a series of AI agents have been deployed to test the software relied upon by Ethereum, searching for vulnerabilities in the cryptographic systems, protocol code, and smart contracts. The vulnerabilities discovered by the AI agents include a remotely triggerable panic issue in the peer-to-peer layer libp2p gossipsub used by the Ethereum consensus client, which has been fixed and disclosed on GitHub as CVE-2026-34219.The researchers noted that the AI agents are organized into specialized roles such as reconnaissance, searching, patching, and verification, aimed at identifying potential attack paths, reproducing failures, and verifying their applicability to production code. The Ethereum Foundation stated that AI has not replaced security researchers but has changed the way they work, allowing the team to cover a much broader scope than manual reviews, although researchers need to exercise more careful judgment over a large number of seemingly credible conclusions.

The Zcash development team announced plans to introduce formal verification through the upcoming new privacy pool Ironwood, using mathematical proofs to eliminate the risk of "undetectable inflation vulnerabilities."According to previous news, although the vulnerabilities in the Orchard shielded pool have been fixed and there is no evidence of exploitation, the community decided to launch a brand new Ironwood shielded pool and conduct comprehensive formal verification of its protocol, as it is theoretically impossible to confirm whether hidden inflation has occurred through on-chain history.

According to CoinDesk, researchers from the blockchain security company Hexens have discovered a "stale cache" type obfuscation vulnerability in the Aptos blockchain Move virtual machine. Attackers only need about $3,000 in server costs to launch an attack in a simulated environment with nearly a 90% success rate, without requiring validator permissions or insider knowledge.In simulated tests, researchers ran about 20 attacks, successfully executing 17-18 times, and verified the potential control over cross-chain protocol management permissions such as LayerZero, Wormhole, and USDC CCTP.Hexens assesses that this vulnerability directly threatens DeFi, stablecoins, and liquid staking protocols on the Aptos chain, involving low single-digit billion-dollar assets; if spread through cross-chain bridges, stablecoin minting, and centralized exchanges, the systemic risk exposure could reach up to $70 billion. The Aptos team completed the fix and deployed it to the mainnet within hours of receiving the vulnerability report on February 25, and currently, no user funds have been compromised.

The Chief Information Security Officer of Slow Fog, 23pds, posted on the X platform that curl recently fixed 18 security vulnerabilities, involving issues such as authentication bypass, memory safety, and host verification, among which one libcurl vulnerability has existed for about 25 years. The risks are not limited to the curl command line but also widely affect applications, SDKs, containers, firmware, gateways, and CI/CD environments that rely on libcurl. It is recommended to upgrade curl/libcurl as soon as possible and check for the use of old versions of libcurl, especially paying attention to mTLS, proxy authentication, and connection reuse scenarios.

Web3 security company GoPlus Security pointed out that there has been a recent surge in smart contract vulnerability attacks, particularly targeting older contracts that have been deployed for many years. Attackers are leveraging AI technology to quickly discover and exploit these vulnerabilities.Recent typical incidents include:On June 9, a Token of Power (TOP) contract deployed 7 years ago was attacked on Ethereum, resulting in a loss of approximately $1.5 million;On May 25, a WUSD.fi contract deployed 3 years ago was attacked, resulting in a loss of approximately $200,000;On June 14 and June 18, Aztec Network was attacked twice in a row due to an old contract deployed 2 years ago, with total losses exceeding $4 million.GoPlus Security believes that traditional auditing methods are insufficient to effectively cover legacy contracts, and adopting AI-based Always-on Audit services may be the most effective solution currently available, capable of conducting security checks on old contracts in a short period while balancing reliability and cost.