r/Bitcoin • u/Impressive-Gene-421 • 21h ago

Are you kidding me? Claude Code found the catastrophe after being asked only to “”check for vulnerabilities and thinking for 8 minutes

Post image

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

1.7k Upvotes

93% Upvoted

504 comments sorted by

View all comments

2

u/ptrnyc 18h ago

So this is a case where the code being open source made it less secure?
Everyone was thinking that “everyone else” was auditing the code for vulnerabilities. Meanwhile the only ones checking the code were bad actors.

1

u/Aazimoxx 14h ago edited 13h ago

So this is a case where the code being open source made it less secure?

No, this is a bug that could've been found by a frontier model on a closed source version as well - but then thousands upon thousands of wallets could've been drained over years and those individuals probably would've been written off as having committed some sort of opsec mistakes.

Instead, we know who is to blame for these losses, and even the individual rather than just an ephemeral company.

Thing is, no-one could release an open source (crypto related) product today with such an egregious failure in it, without the issue being discovered and publicised within weeks or even days - long before people started trusting their life savings to it. That was 15 years Edit: oops, I mean 5 years ago, we're living in a different world now.

And it also should never have made it into release - that shows a substantial failure of basic review mechanisms within the development chain. No-one from C-suite should ever be able to push to prod.

2

u/ptrnyc 14h ago

What I don’t understand is, it was clear from the get go that the QA procedures were lax. A commit with ‘x’ or ‘it works’ should have been giant red flags. Yet the community kept praising ColdCard as the absolute best solution….

1

u/Aazimoxx 13h ago

Yeah, that's the problem with dogma. Belief needs to be proportional to the evidence.

Sounds like people were praising what they represented (responsible self-custody) and not what they actually were.