AI-Assisted Bitcoin Red Team Flags 85 Critical Vulnerabilities

In 27 hours, 16 developers reported 4,962 issues in 390 Bitcoin-related projects, including 85 critical vulnerabilities and 635 high-severity ones. Sixteen developers guided the audit using AI models and about 10,000 dollars of computing power per day, but the volume mainly reveals a triage problem. The priority is now to handle bugs before attackers.

A Bitcoin Red Team Reports a Critical Vulnerability Almost Every Hour

On August 4, Calle, the pseudonymous developer associated with the Cashu protocol, launched a wave of offensive reviews, a red teaming approach that tests the code as an attacker would.

According to Calle, the team was reviewing crypto libraries, wallets, and Bitcoin infrastructures at a rate of about one critical exploit per hour per person, while describing the situation as “extremely bad.” After recent Bitcoin network turbulences, this campaign appears as an ecosystem audit, not a search for a single flaw.

On August 5, the group had 16 members worldwide working 24/7. Their report published on X indicated that after 27.5 hours, the team had opened 4,962 reports across 390 projects, including 85 critical and 635 high-severity issues.

The volume is impressive, but these figures must be read with caution. One report does not yet equate to a confirmed exploit. CoinDesk reports that project leaders had quickly verified most of the critical reports and reproduced them in a local environment with proof of concept.

The True Bottleneck Begins After Discovery

The main problem is no longer detection, but triage, verification, and sending reports to the correct maintainers. Rob Hamilton, who builds the group’s automated setup, summarized this difficulty: the real bottleneck is directing each alert to the right team.

The hardest part is coordinating the delivery of reports to the right people.

This step is as important as the scan itself. A security team must distinguish a real bug from a false positive, establish a reproducible scenario, verify the impact, then provide the maintainer with enough elements to fix it without wasting time.

The group says they publish quickly because maintainers can test reports with the same tools. However, this speed also increases the reception load and requires strict prioritization.

In both cases, AI expands code coverage but doesn’t replace judgment. The useful report isn’t the one that seems alarming; it’s the one a maintainer can reproduce and address.

The Risk Exceeds Bitcoin When AI Also Accelerates Attackers

The tool that expands defense can also reduce the cost of offensive research. CoinDesk recalls that Anthropic found for less than 50 dollars a vulnerability that no one had detected for 27 years in widely used software, while Google said it had spotted a criminal group preparing an attack around a flaw found by a model.

The Bitcoin Red Team burns about 10,000 dollars per day to maintain this pace. This amount does not measure the cost of a real attack, but it shows that computing power and human triage now form a concrete budget item for crypto infrastructure defense.

The Coldcard precedent makes the risk tangible. The thefts that started on July 30 took up to 114 million dollars from wallets whose seeds came from faulty firmware, according to CoinDesk. The case reminds us that a bug can remain exploitable long after its discovery, especially when users do not know they must migrate their funds.

In summary, the Bitcoin Red Team highlights three facts: AI models spot vulnerabilities at high speed, maintainers must absorb and qualify an avalanche of reports, and attackers can use the same methods. The tracking of losses related to the Coldcard hack reminds users that they remain exposed after a team has fixed a flaw, as long as they have not migrated their funds. This campaign does not prove that Bitcoin is compromised, but it shows that its security is now played at an industrial pace. Triage will make the difference.