A volunteer Bitcoin security group identified almost 5,000 potential vulnerabilities during a rapid, artificial intelligence-assisted review of hundreds of projects in the Bitcoin ecosystem. Bitcoin Red Team is a globally distributed group of 16 volunteers.
The group said it reviewed 390 open-source projects and submitted 4,962 findings within roughly 30 hours. The group includes Bitcoin developer Calle and AnchorWatch CEO Rob Hamilton.
Calle said the campaign identified 85 potential critical vulnerabilities and another 635 classified as high severity. That brought the total number of high- and critical-level findings to 720.
The team was producing approximately 2.31 high- or critical-level findings per person per hour, according to Calle’s latest update.
However, the findings should not all be interpreted as confirmed exploitable vulnerabilities. Only 21.4% had been successfully reproduced at the time of the update
(Source: Calle)
AI Accelerates Bitcoin Security Reviews
Bitcoin Red Team is using AI models to examine open-source repositories, identify suspicious sections of code and help researchers test possible attack paths. Calle claimed the group was averaging approximately one potential critical exploit per volunteer per hour during part of the campaign.
The initiative sheds some light on how AI can dramatically expand the amount of code that a small security team can inspect. Traditional manual audits can take weeks or months, particularly when researchers need to understand unfamiliar codebases and reproduce complex failures.
AI systems can search for unsafe assumptions, faulty randomness, access-control mistakes, memory problems and unexpected interactions between software components much faster. Human researchers must then determine whether those findings are genuine, exploitable and relevant to a project’s actual configuration.
The group reportedly spent more than $40,000 on AI services, with funding provided by Bitcoin-focused nonprofit OpenSats. Its custom security harness is expected to eventually be released as open-source software, which could allow Bitcoin companies to test both public and proprietary code.
Coldcard Hack Triggers Ecosystem-Wide Response
The audit campaign follows the discovery of a serious seed-generation vulnerability affecting versions of Coldcard hardware wallet firmware.
Attackers reportedly stole approximately 1,816 BTC, worth around $116 million at the time, from more than 5,200 addresses during four waves of suspicious transactions. Earlier estimates were lower, but the total increased as researchers identified additional affected addresses.
The vulnerability weakened the randomness used to generate certain wallet recovery seeds. This allowed sophisticated attackers to reconstruct private keys without physically possessing the affected devices.
Coldcard manufacturer Coinkite released fixed firmware for affected models. However, updating the firmware alone does not secure funds controlled by a recovery seed that was generated using vulnerable software.
Coinkite advised potentially affected users to update their devices, create completely new recovery seeds and transfer their Bitcoin to addresses controlled by the new seeds. The company said seeds generated with at least 50 independent and private dice rolls were not considered vulnerable to this specific randomness issue alone.
Thousands of Findings Still Require Verification
The scale of the Bitcoin Red Team results could lead to urgent disclosures and software updates across wallets, exchanges, Lightning applications, mining software and other Bitcoin infrastructure.
Nevertheless, the number of initial findings also revealed one of the main limitations of AI-powered security reviews: automated systems can produce false positives, duplicate reports or findings that cannot be exploited under real-world conditions.
Coinkite has also warned development teams that AI security reviews should explicitly test software build processes and submodule boundaries. Vulnerabilities hidden within dependencies, compilation settings or differences between reviewed and deployed code can be missed when an audit focuses only on a project’s main source files.
