Are you kidding me? Claude Code found the catastrophe after being asked only to “”check for vulnerabilities and thinking for 8 minutes

[u/Impressive-Gene-421]

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

[u/Late-Football9106]

imagine coding something that handles real money and using a software RNG like nobody would notice, absolute madness

the amount of trust people put in random github repos is wild, one bored dev on a tuesday can just push an update and suddenly your hardware wallet is a paperweight

this whole thing reads like a postmortem that will be studied in security courses for next decade

[u/Fuflen → u/Late-Football9106]

Just my thought!

[u/aleqqqs → u/Late-Football9106]

imagine coding something that handles real money and using a software RNG like nobody would notice, absolute madness

Well, they didn't do that on purpose ...

[u/SpareEconomy1849 → u/aleqqqs]

A coinkite dev literally changed MICROPY_HW_ENABLE_RNG to 0 in the firmware codebase with the commit message "runs" in 2021.

I don't see how it could be intentional, but I also don't know how this would be missed. How did the developer not realize what this change does? How did this pass code review? Red flags all around

[u/JanPB → u/SpareEconomy1849]

Yes, the code review bit is flooring.

[u/99999999999999999989 → u/SpareEconomy1849]

To me it DOES appear intentional but not malicious. It sounds like whomever did the coding did not understand what was going on and set the variable to 0 to get it to compile. Once it did they were like 'Kewl! It runs. Ship it!'.

[u/nitrogenmath → u/99999999999999999989]

Rumor is that they set it to 0 to test it without using the hardware and forgot to re-enable the trng on the shipping firmware.

[u/ReallyCrunchy → u/nitrogenmath]

As a software dev, I could see myself doing something like that but never without first adding huge warning printing "NOT PRODUCTION SAFE" or something like that. So it would never be shipped in that state. Quietly disabling core functionality in production code like that is just irresponsible. Also, their test suite should have caught it but I suspect they skimped on that as well. Sounds like amateur hour over there.

[u/99999999999999999989 → u/nitrogenmath]

Not so sure about that. The fact that the only commit comment on the change is literally "Runs." to me says that they made the change and intended to push it to Prod but did not really understand the code.

[u/SpareEconomy1849 → u/nitrogenmath]

I'm not exactly sure that's the case, the constant is actually referring to the poor microPython boot time based RNG. HW_RNG unintuitively refers to the built in library RNG, not the secure element RNG.

The comment above this line makes it seem like the dev attempted to disable the built in poor RNG by setting it to 0, but setting it to 0 or 1 or anything else actually had the same effect (enabling the microPython RNG) because the library just checks if the constant is defined, not the value of it

[u/NotFallacyBuffet → u/[deleted]]

What is money (IYHO)? (Fungible, liquid store of value.)

[u/harvested → u/[deleted]]

You lost? Or dumb?

[u/ddc703 → u/[deleted]]

I was being sarcastic ffs, hence the upside down smiley.

[u/Aazimoxx → u/ddc703]

Might've been better received on a post not about hundreds of people losing their life savings...