Bitcoin Red Team files nearly 5,000 security findings across 390 projects in 30 hours

Following a catastrophic exploit of Coldcard hardware wallets that drained over $100 million, a 16-person volunteer group called the Bitcoin Red Team launches an AI-driven security audit. Using advanced AI models funded by OpenSats, the team flags 4,962 vulnerabilities across 390 open-source projects in under 30 hours, including 85 critical bugs. While the blitz aims to secure the ecosystem, the massive volume of reports overwhelms project maintainers and causes widespread coordination challenges.

Bitcoin Red Team security audit

• ▪A 16-person volunteer group called the Bitcoin Red Team, coordinated by pseudonymous developer Calle and Anchorwatch CEO Rob Hamilton, conducted a rapid security audit of Bitcoin codebases in August 2026
• ▪The non-profit organization OpenSats funded the Bitcoin Red Team's security audit, covering over $40,000 spent on AI tokens
• ▪The Bitcoin Red Team utilized a custom-built software harness, which at one point consisted of 171,599 lines of code, to identify, test, and document vulnerabilities in open-source repositories
• ▪The Bitcoin Red Team filed 4,962 security findings across 390 open-source Bitcoin projects within approximately 30 hours of operation in August 2026

Coldcard hardware wallet exploit

• ▪The Coldcard hardware wallet exploit, caused by a random number generator bug dormant since 2021, resulted in the theft of over $100 million from user wallets
• ▪The Bitcoin Red Team's audit was initiated in response to a catastrophic exploit of Coldcard hardware wallets that began on July 30, 2026

Critical vulnerability discoveries

• ▪According to the Bitcoin Red Team, approximately 21.4% of the discovered security findings have been successfully reproduced in local test environments
• ▪Following the AI-driven security findings, the Boltz exchange temporarily paused its operations in August 2026 to address potential security vulnerabilities
• ▪Out of the 4,962 findings filed by the Bitcoin Red Team, the audit identified 85 critical and 635 high-severity security issues

Project maintainer overwhelm

• ▪Pseudonymous developer Calle apologized to project maintainers for the influx of reports and noted that the Bitcoin Red Team was still learning to filter out false positives
• ▪The massive volume of security reports filed by the Bitcoin Red Team in August 2026 overwhelmed open-source project maintainers and created coordination bottlenecks

AI-driven security research

• ▪The Bitcoin Red Team's audit utilized advanced AI models, including Kimi K3, GPT Sol, Fable, Opus, and GLM5.2, to scan open-source repositories
• ▪An AI-assisted audit of Zcash in June 2026 previously discovered a critical bug that could have allowed the unlimited minting of counterfeit ZEC
• ▪Anthropic reported in April 2026 that an unreleased AI model discovered a 27-year-old undiscovered bug in widely used encryption software for less than $50