The tide is turning
I've been looking at code, code reviews, and wallet development for many years. My understanding was always the same: almost all wallets get way too little scrutiny, and the only reason this didn't constantly blow up is that most engineers are too honest. Bugs got found, bugs got responsibly disclosed. But all wallets are full of bugs. Entropy bugs are rare only because entropy is the one thing wallet devs care most about.
That era is over.
Code reviews are now done by clankers, not by professional engineers with years of experience and a pay grade reflecting that. Any kid with a laptop can go on a treasure hunt with very little resources. And every new model generation is better at finding those bugs than the last. ColdCard was our wake-up call.
But there is hope. The defense gets clankers too. Given enough tokens, every bug is shallow. And **cryptography does work**. Neither superintelligence nor quantum computing makes all asymmetric problems symmetric. What the clankers might actually do is turn our 2,000,000 line hardware wallets into 20,000 line hardware wallets and prove the absence of edge cases. Or simply said, eliminate all bugs.
Will the industry pay for that? History says no. Checking your own product's security never paid. Moving fast and breaking things paid. Security engineers were a cost on the balance sheet, which is why most companies in this space pay meager bug bounties or none at all. Right now the defense runs on the goodwill of a few.
@calle, Rob Hamilton and their red team are burning five figures a day in tokens and reporting dozens of bugs per hour to hundreds of open source projects. That is the right panic. It is also goodwill, and goodwill is not an assurance model.
Nobody should run wallet software without plausible assurance of two things. That the binary they are about to install was built from exactly the source that was reviewed. And that this source gets checked for bugs continuously, by someone with no incentive to look away.
The first half is what WalletScrutiny attests today. We track 4,920 products. Most now are dead, fake, or not bitcoin wallets at all. Another 500 are custodial and for a custodial product the binary tells you nothing. Their custody might throttle a hack or lose it all in one go. Inspection only means something for self-custody. That leaves roughly 460 wallets that can be inspected at all, and exactly 121 of them currently pass all transparency tests. Those are the wallets where the binary can provably match the public source. We attest to transparency, not to implementation details. **Nobody attests to implementation details.**
The second half is the continuous review of that source, and done right it costs far less than the panic suggests. Roughly 100 new wallet releases hit our radar every month. With one full review per app on record, each new release only needs a review of the diff. I would be surprised if all the open source diffs together burned more than $1k a day.
Closed source is a different story. A binary diff probably costs as much as ten code diffs, and reverse engineering puts the reviewer in a legal gray area where our first hire might have to be a lawyer. So the priority writes itself. Open source gets reviewed. Everyone else can earn their review by publishing code under a license that invites scrutiny. That is pressure toward actual FOSS.
Even at the lower burn rate, tokens are not free. Neither is the person steering them.
In the grand scheme of things, the bitcoin ecosystem might not have the resources for a thousand bitcoin wallets to exist but maybe we can raise the resources to find out which ones shouldn't.
