The Bitcoin Red Team has flagged 4,962 potential security risks after an AI-assisted sweep of 390 open-source Bitcoin projects, completed in just 30 hours. The 16-member volunteer group, which includes Bitcoin developer Calle and AnchorWatch CEO Rob Hamilton, identified 85 possible critical flaws and 635 high-severity findings. However, researchers have only reproduced 21.4% of the reports, underscoring the gap between automated alerts and confirmed vulnerabilities.
AI Review Finds Thousands of Possible Flaws
The globally distributed team relied on AI models to scan repositories, flag suspicious code, and help researchers test potential attack paths. Nonprofit OpenSats funded over $40,000 in AI services for the campaign. Calle noted that the review produced 720 findings rated high or critical—equivalent to about 2.31 serious findings per volunteer per hour. At its peak, the team reported nearly one potential critical exploit per volunteer each hour. Still, the organizers stressed that these results are leads, not confirmed attacks.
Human Testing Separates Signals from False Alarms
Automated reviews can generate false positives, duplicate reports, and issues that real systems cannot exploit. Traditional audits often take weeks or months due to the need to learn unfamiliar code and reproduce complex failures. AI tools allowed the volunteers to inspect far more code in a short period, but the low reproduction rate means many findings may be noise. Developers await evidence of genuine and exploitable threats before applying fixes.
Coldcard Losses Raise Stakes for Bitcoin Projects
The red-teaming campaign follows the discovery of a serious seed-generation flaw in several Coldcard hardware wallet firmware versions. The defect weakened randomness used to create recovery seeds, and attackers reportedly stole about 1,816 BTC (valued at $116 million at the time) from over 5,200 addresses across four waves of suspicious transactions. The weakness allowed skilled attackers to reconstruct private keys without possessing affected devices. CoinKite released corrected firmware, but an update cannot repair seeds created with vulnerable software. The company advised affected users to install fixes, create new seeds, and move funds to new addresses. Seeds created with 50 private dice rolls avoided this particular flaw.
Conclusion
Bitcoin Red Team’s AI-assisted sweep produced 4,962 potential findings across 390 projects, including 720 high or critical reports. With only 21.4% reproduced, the results highlight the importance of human verification. Bitcoin teams must verify findings, test build systems and dependencies, and issue fixes where confirmed risks affect deployed software. The Red Team plans to release its custom security harness as open-source software to help the community.
Leave a Reply