Bitcoin Red Team audit uncovers nearly 5,000 security flaws in 30 hours

The Bitcoin Red Team, a volunteer group of 16 members, completed a rapid security audit of the Bitcoin ecosystem in under 30 hours, filing 4,962 findings across 390 separate projects using a combination of artificial intelligence tools and human review. The team includes Rob Hamilton, CEO of AnchorWatch, and Bitcoin developer Calle, both of whom have recently voiced concerns about security standards across the Bitcoin ecosystem.

Calle described the pace of discovery as extraordinarily fast, with the team averaging roughly one critical exploit per hour per person. In 29.8 hours, the campaign identified 720 issues classified as high or critical severity out of the total findings. The team has been able to reproduce 21.4% of the findings with proof-of-concept code, which adds confidence to the reported vulnerabilities.

The audit employed a hybrid approach, with much of the work still involving manual oversight alongside AI scanning. Different team members using their own preferred review methods proved most effective, as contributors prompt their agents differently and discover different bugs. About 91% of findings came through automated intake, with eight findings retired as false positives.

The campaign arrives in a tense moment for the Bitcoin ecosystem, following the Coldcard hardware wallet hack that resulted in more than $100 million in stolen Bitcoin. Calle acknowledged the difficult timing in a message to developers, stating "There's a lot of chaos right now in the ecosystem," and recognizing that "many people are being bombarded with security issues right now." The Bitcoin Red Team's work continues, with the group not yet announcing when the audit will conclude or how many additional projects it plans to review.