Bitcoin Red Team scans hundreds of projects, identifies over 1,000 critical vulnerabilities using AI

A group of 16 volunteers just did in 30 hours what would normally take professional audit firms months. The Bitcoin Red Team, a grassroots security initiative, scanned roughly 390 open-source Bitcoin-related projects and surfaced 4,962 security findings, including 85 critical and 635 high-severity vulnerabilities. The effort wasn’t academic. It was triggered by a very real, very expensive disaster. The Coldcard exploit that started it all The Bitcoin Red Team’s audit sprint was a direct response to a firmware vulnerability in Coldcard hardware wallets. That flaw, buried in the device’s random-number generator, led to estimated losses between $70 million and $114 million in stolen Bitcoin. In English: the thing responsible for generating your private keys was broken, which meant attackers could predict those keys. The scale of the losses caught the attention of Calle, a well-known Bitcoin developer, and Rob Hamilton, CEO of AnchorWatch. Together they organized the Red Team campaign in late July and early August 2026, assembling volunteers and securing funding from OpenSats, the open-source Bitcoin grant organization. Total expenditures for the initiative came in at over $40,000. How...