Bitcoin Red Team Uncovers Nearly 5,000 Security Issues Across 390 Projects in AI-Powered Audit

Volunteer Team Launches Massive Ecosystem Security Sweep

A grassroots security collective calling itself the Bitcoin Red Team has completed what it describes as a large-scale ecosystem audit, identifying nearly 5,000 security vulnerabilities across 390 Bitcoin-related projects. The campaign, which deployed AI agents to systematically scan codebases, discovered 85 critical severity issues and 635 high-severity findings within its first 30 hours of operation, according to the Bitcoin Red Team’s initial report published by pseudonymous developer calle, creator of the Cashu Bitcoin ecash protocol.

The team expanded to 16 globally distributed contributors working around the clock, with the audit filing security findings at a rate of 166 per hour. According to the Bitcoin Red Team, 14 human contributors and three automated systems participated in the effort, processing an average of 1.85 serious issues per project scanned. Though much of the work remains manual—described as “hand holding the AI”—the team reports that 91 percent of findings arrived through automated scanning systems.

Methodology Proves Effective at Surfacing Diverse Vulnerabilities

The Bitcoin Red Team’s approach emphasizes decentralized review methods, with each contributor using their own preferred techniques to prompt AI agents. According to calle, this strategy proved more effective than centralized scanning would have been, as different prompting methods uncovered different types of bugs. The team has dynamically reproduced approximately 21 percent of its findings with proof-of-concept code to validate severity.

Severity varies significantly across categories. Privacy and coinjoin tools registered the highest proportion of critical or high-severity issues at 24 percent, followed by swaps and exchanges at 21 percent, and payments and merchant tools at 17 percent. Cryptographic libraries and SDKs generated the largest volume of findings at 1,101 total, though only 10 percent qualified as high or critical severity. The team has already retired eight findings as false positives.

Early Disclosure Raises Stakes for Bitcoin Maintainers

The campaign has placed pressure on open-source maintainers, with findings disclosed upstream to fewer than 20 projects—representing less than 5 percent of those audited. Calle acknowledged the difficulty this creates, writing that the team is “sincerely sorry” if reports added stress to already strained maintainers. The Bitcoin Red Team justified its aggressive disclosure timeline by noting that project owners are best positioned to validate findings and that AI-assisted validation has become nearly cost-free.

The audit arrives amid heightened scrutiny of Bitcoin’s security assumptions. The report references historical incidents, including a 2021 Coinkite Coldcard firmware vulnerability that resulted in losses exceeding $130 million after a faulty update drew wallet seeds from a software fallback rather than hardware randomness.

Source: Bitcoin Red Team, via Decrypt. Not financial advice.