Bitcoin Red Team’s AI-driven audit flagged 85 critical and 635 high-severity issues across 390 open-source repos in under 28 hours of operation.
In the lastest Bitcoin news today, A volunteer security effort called Bitcoin Red Team, led by Bitcoin developer Calle and Rob Hamilton, CEO of AnchorWatch, filed 4,962 findings across 390 open-source Bitcoin repositories in the first 27.5 hours of operation, identifying 85 critical and 635 high-severity issues, according to a Bitcoin Magazine report published August 5, 2026.
The audit was funded through more than $40,000 in AI compute costs, covered by OpenSats, a 501(c)(3) nonprofit dedicated to open-source Bitcoin development.
Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7
We're running a large-scale ecosystem security audit across bitcoin code bases.
27.5 hours in, we've filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues.
We're at… pic.twitter.com/iRCylprbY1
— calle (@callebtc) August 5, 2026
This is not simply a bug-bounty sweep. It is a structural stress test of the entire Bitcoin software ecosystem, triggered by a critical random number generator (RNG) vulnerability in Coldcard hardware wallets that has resulted in more than $100 million in confirmed Bitcoin losses.
EXPLORE: Best Meme Coins to Buy for August
Bitcoin News Today: BTC Red Team Audit, Scope, Methodology, and AI Stack
The Red Team’s review harness, which reached 171,599 lines of code, is designed to identify load-bearing Bitcoin software libraries, document vulnerabilities, reproduce them locally, and package results into responsible disclosure reports for affected maintainers.
21.4% of findings have been reproducible as of the latest update, and Calle described the team’s pace as averaging roughly one critical exploit per hour per person.
The AI models deployed include Kimi K3, GPT Sol, Fable, Opus, and GLM5.2. Early in the operation, access to OpenAI and Anthropic infrastructure was restricted, forcing heavier reliance on Chinese open-source models, a dynamic that drew comment from industry observers who flagged it as a signal of uneven U.S. AI access.
red teaming bitcoin:
– we’ve written multiple harnesses and we’re launching a huge wave of reviews against many core bitcoin projects: crypto libs, wallets, infra, …
– situation is extremely bad.
– we’re averaging on the order of 1 critical exploit per hour per person.
– we’ve… https://t.co/9zlaaObU03— calle (@callebtc) August 4, 2026
Hamilton’s August 4 post referenced Fable, indicating Anthropic access had been established, and OpenAI has since confirmed access to GPT Sol for the project.
The team has no public website or GitHub repository at this writing, but Hamilton has stated the harness will be open-sourced so that Bitcoin companies can run it against closed-source codebases – a step that would extend the audit surface beyond the 390 repositories already reviewed.
Background: Coldcard Exploit as the Catalyst
The Red Team effort launched directly in response to the Coldcard breach, in which attackers exploited a flaw in the wallet’s RNG to drain funds from MK3+ devices. At least 15 distinct attackers have been identified by Galaxy Research as having exploited the vulnerability, per a separate Cointelegraph report. Coinkite, the manufacturer, has released patched firmware, but Bitcoin Magazine’s advisory notes that users who have not migrated funds to seeds generated under secure firmware remain at risk.
Boltz exchange separately announced a temporary operational pause to address AI-driven vulnerability discovery stemming from the same post-Coldcard security environment, illustrating how the Red Team’s work is creating immediate, industry-wide triage pressure.
DISCOVER: Best Meme Coins to Buy in 2026
next