Bitcoin Red Team files 4,962 security findings across 390 projects

The Bitcoin Red Team, a 16-person volunteer group, filed 4,962 security findings across 390 Bitcoin projects in roughly 30 hours using AI agents to scan open-source codebases. Pseudonymous developer Calle, who created the Bitcoin ecash protocol Cashu, published the campaign's first situation report, documenting 85 critical and 635 high-severity findings filed at a rate of 166 per hour.

Much of the work remains manual, with Calle describing the process as "hand holding the AI," though automated harnesses are improving. Contributors reported that 91% of findings arrived through automated scanning, and different team members using their own preferred review methods proved most effective because varied AI prompting generates different bug discoveries. Around 21% of findings have been dynamically reproduced with proof-of-concept code.

Severity varies sharply by project category. Privacy and coinjoin tools showed the highest concentration of serious issues at 24%, followed by swaps and exchanges at 21% and payments tools at 17%. Cryptographic libraries and SDKs produced the largest raw volume at 1,101 findings, but only 10% reached the high-severity threshold.

Calle acknowledged the campaign adds stress to an already difficult moment for maintainers. Only 19 projects—under 5% of those reviewed—have had findings disclosed upstream so far. He argued the findings should circulate quickly because project owners are best positioned to validate them and validation is now nearly free with AI assistance. The campaign lands as Bitcoin's security assumptions face fresh scrutiny following the Coldcard wallet compromise, which cost users approximately $130 million.