Bitcoin AI security audit files 4,962 findings across 390 projects

Volunteer group Bitcoin Red Team pointed AI agents at Bitcoin project codebases and reviewed 390 repositories in 27.5 hours, filing 4,962 findings in total — 85 of them flagged as critical and 635 as high severity. The sprint was triggered by the Coldcard hardware wallet hack.

The sprint involved 16 developers, with compute costs running around $10,000 a day — averaging roughly one critical finding per hour per person. Most critical reports were quickly verified by the project teams themselves: before handing a finding to owners, the group built a working proof-of-concept confirming the vulnerability was real, not a model false positive. The sprint itself was triggered by the Coldcard hardware wallet hack: waves of thefts starting July 30 drained up to $114 million from wallets through a bug dormant in the code since 2021 that required no physical access to the device once an attacker had located the vulnerable key space.

“Situation is extremely bad. There's a lot of chaos right now in the ecosystem.”

— Calle, Bitcoin Red Team member

• 390 projects reviewed in 27.5 hours, 4,962 findings, 85 critical and 635 high severity
• 16 developers involved, compute costs around $10,000 a day
• Triggered by the Coldcard hack: waves of thefts since July 30 drained up to $114 million via a bug dormant since 2021

We've been closely following the Coldcard hack itself: we covered how a fourth wave pushed the damage toward $114 million, and rounded up a weekly crypto security digest. This AI sprint shows the flip side of the hack: a single incident became the catalyst for a systematic review of Bitcoin's entire open-source infrastructure — meaning the industry is responding not just with a point patch, but with preemptive hunting for similar problems before anyone exploits them.

None of this should be read as personalized investment advice.