AI-Driven 'Red Team' Audit Uncovers 85 Critical Flaws in Bitcoin Open-Source Repos

A volunteer collective known as the Bitcoin Red Team has uncovered thousands of security vulnerabilities across the Bitcoin open-source ecosystem using AI-accelerated auditing. The effort highlights a systemic fragility in the software supporting self-custody, proving that critical flaws can persist in public code undetected for years.

Over a period of approximately 27.5 hours, 16 globally distributed researchers identified 4,962 security findings across 390 open-source repositories. Of these, 85 were classified as critical and 635 as high-severity flaws. The audit was co-led by Rob Hamilton, CEO of AnchorWatch, and developer Calle, the maintainer of Bitchat Android. To power the search, the nonprofit OpenSats funded approximately $40,000 in AI model token costs, utilizing models including GLM5.2 and Kimi K3.

The Coldcard Catalyst

This adversarial surge was a direct response to a catastrophic failure in Coldcard firmware. A bug caused the device to use a weak software pseudo-random number generator (PRNG) instead of hardware-based randomness. This failure allowed attackers to predict private keys, resulting in an estimated $88.6 million in drained funds across 4,585 addresses. The disaster underscored a dangerous reality: while Bitcoin's infrastructure is largely open-source, public availability does not guarantee that the code has been rigorously audited.

Implications for Digital Custody

The scale and speed of the Red Team's findings suggest that traditional human-led audits are no longer sufficient for the fragmented landscape of Bitcoin tooling. By leveraging a hybrid AI-human approach, the team scanned hundreds of projects in a fraction of the time a standard security firm would require. The fact that $40,000 in compute costs could uncover flaws that potentially jeopardize billions in assets suggests that AI-driven red-teaming is now the most viable path for securing the ecosystem's perimeter.

Future Outlook

As the Bitcoin Red Team continues to publish its findings, the industry must now grapple with the remediation of these 4,962 issues. The focus shifts to whether open-source maintainers can patch these vulnerabilities faster than attackers can exploit them. For users, the event serves as a stark reminder that the "open source" label is not a substitute for verified security audits, and the reliance on a few critical libraries creates single points of failure for millions of holders.