A volunteer group calling itself the Bitcoin Red Team has filed 4,962 security findings across 390 Bitcoin projects in roughly 30 hours, using AI agents to run what the group describes as a ‘large-scale ecosystem audit’ of Bitcoin codebases.
Critical and High-Severity Findings
Pseudonymous developer calle, creator of the Bitcoin ecash protocol Cashu, published the campaign’s first situation report on Wednesday. Of the 4,962 findings, 85 are rated critical severity and 635 are rated high, together accounting for 14.5% of the total corpus. That works out to an average of 1.85 serious issues per project, with findings arriving at a rate of 166 per hour.
Calle said the team has grown to 16 people working around the clock. The report logs 17 contributors in total: 14 human and three automated.
How the Audit Works
Much of the work remains manual, with contributors ‘hand holding the AI,’ according to calle, though automated harnesses are improving. Some 91% of findings arrived through automated scan intake. The group lets each contributor use their own preferred review method, which calle described as ‘the most effective strategy’ because contributors prompt their agents differently and surface different bugs. Around 21% of findings have been dynamically reproduced with proof-of-concept code.
The severity breakdown varies by category. Privacy and coinjoin tools returned the highest proportion of high-or-critical findings at 24%, followed by swaps and exchanges at 21% and payments and merchant tools at 17%. Cryptographic libraries and SDKs produced the largest raw volume at 1,101 findings, but only 10% of those cleared the high-severity bar.
Maintainers Getting Flooded
Only 19 projects, under 5% of those reviewed, have had findings disclosed upstream so far. Calle acknowledged the pace is adding pressure on project maintainers.
‘We’re sincerely sorry if our reports added stress to your already stressful day,’ calle wrote, while arguing rapid disclosure is justified because project owners are best placed to validate findings, AI validation is now nearly free, and any other party running the same tools will reach the same bugs independently. Eight findings have been retired as false positives.
The Coldcard Backdrop
The campaign arrives as Bitcoin’s security assumptions face fresh scrutiny. Coinkite’s Coldcard hardware wallet lost users approximately $130 million after a March 2021 firmware build drew wallet seeds from a software fallback rather than the device’s dedicated hardware random number generator, leaving private keys guessable. In its post-mortem, Coinkite noted it was likely that ‘someone used AI to review previous versions of our firmware.’
Ledger chief technology officer Charles Guillemet, whose company sells a competing hardware wallet, said the incident showed AI was now being used to identify vulnerabilities in crypto code ‘at machine speed.’ He added that ‘open source and reviewed are not the same thing,’ noting the Coldcard flaw sat in public code for more than five years before an adversary reportedly used AI to find it. Defence, Guillemet argued, must now move at the same speed as attackers.
