On August 5, the volunteer group Bitcoin Red Team announced the discovery of 4,962 potential security vulnerabilities across 390 projects related to Bitcoin. Among these, 85 were classified as critical risks, while another 635 were deemed high severity.
Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7
— calle (@callebtc) August 5, 2026
We're running a large-scale ecosystem security audit across bitcoin code bases.
27.5 hours in, we've filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues.
We're at… pic.twitter.com/iRCylprbY1
Within the initial 29.8 hours of the audit, the team was able to reproduce 21.4% of the findings. The other results remain unverified as vulnerabilities. This audit was initiated following attacks on Coldcard hardware wallets, which resulted in losses exceeding $100 million.
Scope of Bitcoin Red Team's Audit
The Bitcoin Red Team is assessing cryptographic libraries, wallets, infrastructure software, and other open-source projects. The initiative involves 16 experts, including Calle, a developer of the Cashu protocol, and Rob Hamilton, CEO of AnchorWatch.
The team employs AI models alongside manual reviews. They have developed several testing tools that load code, identify potentially dangerous areas, and assist in simulating possible attacks in a controlled environment.
This method is referred to as red teaming, where researchers not only seek out errors but also evaluate whether these can be exploited to compromise a product.
According to Calle, team members typically identify about one critical exploit per hour per person, although he did not disclose the methodology behind this calculation.
We've been reaching out to many folks. Most of the critical reports we've made so far were quickly verified by project owners. We know we're hitting real targets.
— calle (@callebtc) August 5, 2026
There's a lot of chaos right now in the ecosystem. We absolutely understand that many people are being bombarded… pic.twitter.com/vx57ejIiko
“There’s a lot of chaos in the ecosystem right now. We understand that many are overwhelmed with reports regarding security issues,” the developer noted.
The team has not disclosed the specific projects affected. Calle mentioned that critical reports are first verified through a working attack example before being privately communicated to developers.
Motivation Behind the Audit
This initiative was launched in response to a vulnerability exploited in Coldcard hardware wallets. Galaxy Research reported that at least 15 different attackers took advantage of this flaw, with losses from three confirmed waves estimated at $100 million. If a suspected fourth wave materializes, this figure could rise to approximately $130 million.
In a technical analysis, Coinkite, the manufacturer of these devices, explained that the error originated from firmware changes made in 2021. In certain cases, devices relied on a predictable software random number generator instead of a hardware generator.
Block arrived at a similar conclusion after reviewing the code. Researchers cautioned that they have not yet completed thorough testing of all affected devices.
Coinkite estimated that the effective entropy of seed phrases dropped from 128 bits to about 40 bits for Coldcard Mk2 and Mk3. For Mk4, Mk5, and Q, the figure was around 72 bits. The company has released updated firmware, but this does not secure already generated seed phrases. Owners of affected wallets have been advised to generate new seed phrases on a fixed device and transfer funds to different addresses.
AI's Role in the Audit
Hamilton highlighted that the primary limitation of the campaign is not the identification of issues but rather the communication of reports to the appropriate developers.
Bitcoin Red Team Update:
— Rob Hamilton (@Rob1Ham) August 4, 2026
We have been working around the clock, with ~$20,000 of spend up to this point across different services. Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of.
We have done over a dozen…
“We have made over a dozen disclosures so far, scanning 150 repositories. The most challenging part is coordinating to relay information to the right people,” he noted.
Previously, the Anthropic team used the AI model Claude to identify 22 vulnerabilities in the Firefox browser, 14 of which were classified by the developer Mozilla as high severity.
It is worth noting that in July, ForkLog examined how artificial intelligence is transforming the bug bounty market and increasing the burden on developers and security specialists.