r/Bitcoin: auditing cold-wallet code with AI instead of relying on dice entropy
reddit-audit-cold-wallets-ai
https://www.reddit.com/r/Bitcoin/comments/1vhsp5a/audit_of_cold_wallets/
Latest reviewed change
source content difference between and
The thread gained a comment describing COLDCARD firmware reproducible builds and another comment suggesting wallets with two independent randomness sources.
Reddit have some auto translation at least if you google something in some language and it will give result in that language, im not sure if it can be activated somehow so it does it without google too.
[See this current post were are in](https://www.reddit.com/r/Bitcoin/comments/1vhsp5a/audit_of_cold_wallets/?tl=es-419), but I added ES to the url
+
+comment: p2v6avf
+parent: t1_p27s42w
+author: JumpProfessional3372
+created_utc: 1786380148
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 1
- Detected differences
- 1
- Unreviewed
- 0
- Copies held
- 2
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The thread gained a comment describing COLDCARD firmware reproducible builds and another comment suggesting wallets with two independent randomness sources.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 20 lines
Reddit have some auto translation at least if you google something in some language and it will give result in that language, im not sure if it can be activated somehow so it does it without google too. [See this current post were are in](https://www.reddit.com/r/Bitcoin/comments/1vhsp5a/audit_of_cold_wallets/?tl=es-419), but I added ES to the url + +comment: p2v6avf +parent: t1_p27s42w +author: JumpProfessional3372 +created_utc: 1786380148 +edited: false +body: +With Coldcard you can pull the firmware code, compile the firmware update file and check that the bytes matches the one from the vendor (signed by them). I remember I did 2 years ago with the 5.2.2 firmware before flashing it. + +But I can't remember if i followed the process they put in their github to do this (Reproducible builds section) or a custom way of doing it. + +[https://github.com/Coldcard/firmware](https://github.com/Coldcard/firmware) + +comment: p2vd2p6 +parent: t3_1vhsp5a +author: No-Wrap3568 +created_utc: 1786381852 +edited: false +body: +Wallet with Two independent sources of randomness could be an answer to thisExtracted text as captured
post: 1vhsp5a author: LittleWiseGuy3 created_utc: 1786083745 title: audit of cold wallets body: After all the trouble with Coldcard, all bitcoiners are very paranoid. I have seen many posts about generating your own entropy with dice and creating an air-gapped multisig and many other things. But I think it is easier to audit the cold wallet you are using. If they are open source, today it is very easy with any AI to review the code and look for vulnerabilities of this kind or any other that could compromise your funds remotely. Also, a good passphrase will protect you from most types of remote attacks. And this way you make sure your funds are safe without becoming paranoid and making a million dice rolls. It is just my opinion comment: p27rc5h parent: t3_1vhsp5a author: Javanaut018 created_utc: 1786084059 edited: false body: Just go ahead comment: p27s0yr parent: t3_1vhsp5a author: CBpegasus created_utc: 1786084375 edited: false body: CoinKite claim they used AI to audit the code and it didn't find anything. I can believe that because LLMs sometimes fall to the same pitfalls humans do - seeing something that "looks correct" and and assuming it is correct. And the code "looked correct", especially with the reassuring comment on the fatal #define (LLMs often treat comments as factual if not explicitly told otherwise). That's why I'm not sure of the circulating claim that the vulnerability was found by AI btw. I think the hackers did a slightly more advanced (and more traditional) audit than just feeding the code to AI and telling it "find bug". Anyway I think if you're not quite experienced in these matters you probably can't do a good enough audit yourself, AI or no. Traditionally the idea with open source is that you know many other people also could have audited the code, but that's not a guarantee either. I think rolling dice for 15 minutes is probably an easier and more effective thing than an AI based audit. comment: p27s42w parent: t3_1vhsp5a author: WellThatEscalatez created_utc: 1786084412 edited: false body: theres no way to prove the open source code is the code on your device..Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1vhsp5a author: LittleWiseGuy3 created_utc: 1786083745 title: audit of cold wallets body: After all the trouble with Coldcard, all bitcoiners are very paranoid. I have seen many posts about generating your own entropy with dice and creating an air-gapped multisig and many other things. But I think it is easier to audit the cold wallet you are using. If they are open source, today it is very easy with any AI to review the code and look for vulnerabilities of this kind or any other that could compromise your funds remotely. Also, a good passphrase will protect you from most types of remote attacks. And this way you make sure your funds are safe without becoming paranoid and making a million dice rolls. It is just my opinion comment: p27rc5h parent: t3_1vhsp5a author: Javanaut018 created_utc: 1786084059 edited: false body: Just go ahead comment: p27s0yr parent: t3_1vhsp5a author: CBpegasus created_utc: 1786084375 edited: false body: CoinKite claim they used AI to audit the code and it didn't find anything. I can believe that because LLMs sometimes fall to the same pitfalls humans do - seeing something that "looks correct" and and assuming it is correct. And the code "looked correct", especially with the reassuring comment on the fatal #define (LLMs often treat comments as factual if not explicitly told otherwise). That's why I'm not sure of the circulating claim that the vulnerability was found by AI btw. I think the hackers did a slightly more advanced (and more traditional) audit than just feeding the code to AI and telling it "find bug". Anyway I think if you're not quite experienced in these matters you probably can't do a good enough audit yourself, AI or no. Traditionally the idea with open source is that you know many other people also could have audited the code, but that's not a guarantee either. I think rolling dice for 15 minutes is probably an easier and more effective thing than an AI based audit. comment: p27s42w parent: t3_1vhsp5a author: WellThatEscalatez created_utc: 1786084412 edited: false body: theres no way to prove the open source code is the code on your device..Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.