256 Foundation launches ASIC firmware review and files 41 issue reports

Bitcoin News said in a post on X that 256 Foundation has launched the 256 Red Team, a security effort focused on auditing ASIC miner firmware. The project uses reverse engineering, live traffic capture, and share-level reconciliation to inspect firmware behavior. According to the team, it has filed 41 issue reports covering Bitmain’s stock firmware as well as third-party options including LuxOS, VNISH, and Braiins OS. Reported findings include unauthenticated factory APIs, paths that can lead to root access, default credentials, embedded vendor SSH keys, and update mechanisms that cannot verify what is being installed. After decompiling Bitmain’s miner daemon and reviewing live connections, researchers said they found no evidence in Bitmain’s original firmware of hashrate skimming, a remote kill switch, or covert beacons. They said the main risks were concentrated in third-party “optimization” firmware. The team has also sent three responsible disclosures to VNISH, Luxor, and Braiins, giving each party 30 days to respond before public disclosure. MicroBT, Canaan, Auradine, Bitdeer, and ePIC are set for later audits.