Sixteen developers spent under thirty hours combing through Bitcoin's codebase and turned up almost five thousand potential security flaws. Eighty-five of them got flagged critical — bugs that could, in theory, let an attacker drain a wallet without the owner doing anything wrong.
The trigger was the Coldcard Mk3 debacle. Late July, researchers realized the hardware wallet's firmware had been carrying a random-number-generator bug since 2021: instead of pulling entropy from the device's hardware source, it sometimes fell back to a predictable software generator. Attackers who mapped out the weakened key space pulled more than $100 million out of affected wallets — no physical access to the device required.
That's what pushed a volunteer group calling itself the Bitcoin Red Team into action. Led by a pseudonymous Cashu developer known as Calle and Rob Hamilton, CEO of AnchorWatch, the team skipped the usual line-by-line manual review and pointed AI models at 390 open-source repositories — wallets, cryptographic libraries, infrastructure code. The pace: roughly 180 findings an hour, or about one critical bug per person, per hour. Compute alone reportedly ran up to $10,000 a day.
Speed came with a catch. As of publication, only 21.4% of the findings had actually been reproduced and confirmed. That doesn't mean the rest are fake — many simply haven't reached the right maintainer yet — but it does mean the full 4,962-item list shouldn't be read as 4,962 confirmed holes. Calle put it bluntly: "the situation is extremely bad," and apologized to maintainers for the flood of reports. The team tried to disclose critical issues privately first, but the sheer volume left several project owners unable to keep up.
It's a working demonstration that AI tooling can surface bugs human auditors missed for years — the Coldcard flaw sat undetected for five. But the same speed just moved the bottleneck: it's no longer finding vulnerabilities that's slow, it's the maintainers' capacity to verify them.
