41 Security Vulnerabilities Found in Bitcoin Miner Firmware Audit

A security audit of Bitcoin (BTC) miner firmware has revealed 41 vulnerabilities in third-party software. The 256 Foundation conducted its first firmware security audit targeting Bitmain's S19j Pro and S21 stock firmware, as well as LuxOS, VNISH, and Braiins OS. No signs of hash rate skimming, covert communication beacons, or malicious activity were found in Bitmain's stock firmware. However, 41 security concerns were raised regarding third-party firmware such as LuxOS, VNISH, and Braiins OS, including unupdated default fleet credentials, SSH keys included in firmware images, unauthenticated factory APIs, and update paths that skip password verification. The audit results are limited to specific models and firmware, making it difficult to apply to all miners and firmware. The 256 Foundation aims to transform Bitcoin mining infrastructure into an open-source structure, asserting that miners should be able to read and verify the software of their equipment. This audit highlights the tension between closed-source firmware and third-party firmware. LuxOS has stated that it has completed a SOC 2 Type 2 audit, while Braiins OS provides guidance on public key and GPG signature verification procedures. The community has raised questions about firmware installation and recovery procedures, and discussions on Bitcoin security are also linked to practical issues such as seed generation implementation errors in hardware wallets.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.