Volunteer group Bitcoin Red Team reviewed 390 projects across the Bitcoin ecosystem in its first 30 hours of work and filed 4,962 potential findings. The group now counts 16 contributors working around the clock in shifts from different countries, running AI agents against open-source code and averaging roughly one critical exploit per hour per person.
For an industry where millions of dollars ride on the quality of wallet and exchange code, that pace looks unprecedented. The team started smaller and grew to its current 16 members within days, and most of the findings came through automated scanning rather than manual human review.
Some of the work is still done by hand. Calle said contributors are still "hand holding the AI" through the trickier parts of the codebase, though automated scanning harnesses keep improving and should need less human input over time.
Who is behind Bitcoin Red Team
Bitcoin Red Team formed as a volunteer response to a wave of hardware wallet attacks in the summer of 2026. The group includes Rob Hamilton, CEO of AnchorWatch, and a pseudonymous developer known as Calle, who posted the first update on the campaign on X.
Members are not waiting on official bug bounty programs, and there is no central funding behind the effort. Each contributor runs their own AI tooling against open-source code, from wallets to payment services, files reports directly to repository maintainers, and picks their own review method. Paid audits of this scale usually take months and cost real money, while the volunteer model compresses that process into hours, at the cost of some of the formal methodology that comes with commercial reviews.
4,962 findings in 30 hours
According to Calle, the team filed 4,962 reports across 390 projects in the first 29.8 hours of the campaign. Of those, 85 are marked critical and another 635 high severity. Together that is 720 serious findings, about 14.5% of the total.
The pace comes down to letting people choose their own tools. Calle said every contributor prompts AI agents differently, so the team ends up catching different bug classes instead of filing duplicate reports. He called that decentralized review model the most effective strategy the team has tried so far.
"We're averaging on the order of one critical exploit per hour per person."
- Calle, Bitcoin developer, from a post on X on August 5, 2026
Where the risk runs highest: privacy, exchanges, payments
Severity varies sharply by project type. Privacy and coinjoin tools returned the highest share of critical or high findings within their category, at 24%. Swap and exchange services followed at 21%, and payment and merchant tools came in at 17%.
Cryptographic libraries and SDKs produced the largest raw volume, 1,101 findings, but only 10% of those cleared the high or critical bar. That kind of code typically goes through formal audits more often than small wallets or payment plugins do, leaving less room for issues to go unnoticed.
The gap between categories points to where security resources have historically run thinnest. Small teams building privacy tools rarely have budget for regular outside audits, while large cryptographic libraries have spent years under close scrutiny from researchers.
Maintainers are getting more reports than they can process
Only 19 projects, under 5% of those reviewed, have disclosed their findings publicly so far. Calle acknowledged the chaos of the moment, saying the team understands how many people are being flooded with security notices at once.
- Only 19 projects have disclosed findings publicly
- 8 reports have already been retired as false positives
- 21.4% of vulnerabilities are confirmed with working exploit code
- The team runs around the clock in shifts, with 16 people active at a time
The old norm of responsible disclosure assumes months of silence while developers build a patch. Mass AI auditing breaks that model, since code review has gotten cheap enough for anyone to run, and staying quiet no longer buys as much time as it used to. For maintainers of smaller projects, that means a faster response cycle measured in days rather than weeks.
Coldcard's shadow over the industry
The Bitcoin Red Team campaign launched days after the high-profile Coldcard wallet hack. In March 2026, a firmware build on the device began drawing wallet seeds from a software fallback instead of the hardware random number generator, leaving private keys guessable. Attackers are estimated to have drained tens of millions of dollars in Bitcoin, and later tallies pushed the total closer to $130 million. Kurslog previously covered the fourth wave of the Coldcard attack, when total losses had already topped $114 million.
In its own post-mortem, maker Coinkite suggested someone had likely used AI to review earlier versions of its firmware and find the flaw. Ledger chief technology officer Charles Guillemet told Decrypt the incident showed that AI is now hunting for flaws in crypto code at machine speed. Open source and reviewed code are not the same thing, he said, since the Coldcard flaw sat in a public repository for more than five years before someone used AI to find it.
Owners of Ledger and other hardware wallets are now in a spot where attackers and defenders reach for the same tools. Defense has to move at the same speed as offense, Guillemet argued, and that is exactly what Bitcoin Red Team is trying to prove with its daily numbers.
What it means for Bitcoin holders
For an average user, 4,962 reports in 30 hours does not mean the Bitcoin ecosystem suddenly got riskier. If anything, it is the opposite. These flaws sat unnoticed in the code for years, and now volunteers are finding them first instead of attackers.
AI-assisted code review has gotten cheap enough that both sides, defenders and attackers, gained access to it at the same time. The winner in that race is whoever patches faster, not whoever talks about it louder. For wallet owners and exchange users, the practical takeaway is simple. Install firmware and app updates without delay, since the window between a public disclosure and a working exploit has shrunk to hours.
Campaigns like this are unlikely to stay confined to Bitcoin. Ethereum, Solana, and other open-source networks face the same exposure. The cheaper AI-assisted code review gets, the faster findings can end up in the wrong hands if development teams cannot respond first. Bitcoin Red Team is effectively testing a model of mass volunteer auditing that other ecosystems will likely have to replicate sooner or later.
Comments
Your email address will not be published. Required fields are marked *