On August 5, the volunteer group Bitcoin Red Team reported 4,962 potential security issues across 390 projects related to the leading cryptocurrency. Of these, 85 were classified as critical risk, and another 635 as high risk.
Bitcoin Red Team update: we’ve grown to 16 globally distributed people working 24/7
We’re running a large-scale ecosystem security audit across bitcoin code bases.
27.5 hours in, we’ve filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues.
We’re at… pic.twitter.com/iRCylprbY1
— calle (@callebtc) August 5, 2026
In the first 29.8 hours, participants managed to reproduce 21.4% of the findings. The remaining results cannot yet be considered confirmed vulnerabilities. The audit was initiated following attacks on Coldcard hardware wallets, which resulted in losses exceeding $100 million.
What Bitcoin Red Team Examines
Bitcoin Red Team analyzes cryptographic libraries, wallets, infrastructure software, and other open-source projects. The initiative involves 16 specialists, including Cashu protocol developer Calle and AnchorWatch CEO Rob Hamilton.
The team uses AI models alongside manual checks. Participants have developed several testing tools that download code, identify potentially dangerous areas, and help simulate possible attacks in a local environment.
This approach is known as red teaming, or simulating attacker actions. Researchers not only look for errors but also try to determine if they can be used to compromise a product.
According to Calle, participants find about one critical exploit per hour per person on average. He did not disclose the calculation method.
We’ve been reaching out to many folks. Most of the critical reports we’ve made so far were quickly verified by project owners. We know we’re hitting real targets.
There’s a lot of chaos right now in the ecosystem. We absolutely understand that many people are being bombarded… pic.twitter.com/vx57ejIiko
— calle (@callebtc) August 5, 2026
“There’s a lot of chaos in the ecosystem right now. We understand that many are being overwhelmed with security issue reports,” the developer wrote.
The team did not disclose the list of affected projects. According to Calle, critical reports are first reproduced using a working attack example and then privately shared with developers.
Reason for the Audits
The campaign began in response to the exploitation of a flaw in Coldcard hardware wallets. According to Galaxy Research, at least 15 different attackers exploited the vulnerability. Losses from three confirmed waves were estimated at $100 million. Considering a suspected fourth wave, the total could rise to approximately $130 million.
In a technical analysis, device manufacturer Coinkite explained that the flaw emerged after firmware changes in 2021. Instead of using a hardware random number generator, the devices sometimes relied on a predictable MicroPython software generator.
The Block team reached a similar conclusion after examining the code. Researchers warned that they have not completed full testing of all affected devices.
Coinkite estimated that the effective entropy of seed phrases decreased from 128 bits to about 40 bits for Coldcard Mk2 and Mk3. For Mk4, Mk5, and Q, the figure was around 72 bits. The company released updated firmware, but the update does not protect already created seed phrases. Owners of affected wallets were advised to generate new ones on a fixed device and transfer funds to other addresses.
AI Accelerated Discovery, Not Verification
Hamilton identified the main limitation of the campaign as not the discovery of issues, but the delivery of reports to the right developers.
Bitcoin Red Team Update:
We have been working around the clock, with ~$20,000 of spend up to this point across different services. Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of.
We have done over a dozen…
— Rob Hamilton (@Rob1Ham) August 4, 2026
“We’ve made over a dozen disclosures so far, scanning 150 repositories. The hardest part is coordinating to get the information to the right people,” he noted.
Previously, the Anthropic team used the AI model Claude to identify 22 vulnerabilities in the Firefox browser, 14 of which were classified by developer Mozilla as high severity.
In July, ForkLog explored how artificial intelligence is changing the bug bounty market and increasing the workload on developers and security specialists.
