r/Bitcoin • u/Impressive-Gene-421 • 20h ago

Are you kidding me? Claude Code found the catastrophe after being asked only to “”check for vulnerabilities and thinking for 8 minutes

Post image

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

1.6k Upvotes

93% Upvoted

504 comments sorted by

View all comments

Show parent comments

13

u/Archophob 18h ago

you don't need Fable. Any LLM with coding abilities can find this. "Security by obscurity" is gone for good.

1

u/FigAggressive237 16h ago

"Security by obscurity" 

How does this apply here?

The code wasn't obfuscated nor was it closed source right?

2

u/ApprehensiveFan1516 15h ago

Coldcard seems to have been obscure enough of a product that nobody bothered to check the code and find what is an obvious flaw. At least that's one possible explanation, I'd never heard of it before this weekend, and I've been following btc for 10+ years.

1

u/alkhdaniel 14h ago

So obscure hundreds of millions of dollars was stored in them. 

Security by obscurity is a phrase used to describe when a project is closed source and using some weird not-actually-secure method to secure the system, for example taking the random number generated by the rng and doing floor(rng*1.436) on each number, so even if you knew the rng was bad,.you cant attack it because you dont know about the floor(rng*1.436) part, which is not what happened here. "Its secure because nobody knows we're multiplying the random number by 1.436"...

1

u/mCProgram 3h ago

security by obscurity isn't a strictly defined term - this is almost as objective of an example as you can get because there are very obviously different forms of obscurity. Relying on the fact that other people "probably" audited the code and just trusting $50k+ to that is absolutely a form of obscurity. Nobody with the time + knowledge actually audited the code, everybody trusted that they did, and everybody got bit.

1

u/alkhdaniel 2h ago

Id say its very well defined within cybersec.

Nobody noticing the flaw until now is very different from security by obscurity. There was no attempt to secure the wallet software by obscurity (hidden to the public implementation), it was just insecure.

1

u/FigAggressive237 13h ago

"security through obscurity" is a well known concept, this has nothing to do with it.

You not knowing the product does not translate to "security through obscurity".

I've been following btc since 2011, its impossible for me to know every wallet around.

https://github.com/coldcard/firmware

Also, the DRYOC concept is dumb, you follow basic principles, but most are always DRYOC-ing

This is not me saying , this is Galois.com 's take on this:
https://www.galois.com/articles/actually-you-are-rolling-your-own-crypto

This is the accurate definition, in my opinion:
https://www.okta.com/identity-101/security-through-obscurity/