The Bitcoin Red Team recorded 4,962 security findings after running advanced AI models against 390 open-source repositories during an intensive audit spanning about 27.5 hours on August 4 and 5. The findings included 635 issues initially classified as high severity, alongside the 85 placed in the critical category.
The classifications remain preliminary. Each alert must be reproduced, assessed by a human researcher and disclosed privately to the relevant software maintainer before it can be treated as a confirmed vulnerability. Only a minority of the findings had completed that process when the initial figures were released.
The group comprises about 16 volunteer researchers and was formed to examine wallets, payment tools, libraries, node software and other applications surrounding the Bitcoin network. Its work does not establish that Bitcoin’s underlying protocol has been compromised or that every identified problem could be exploited.
Researchers described the volume and pace of discoveries as an “extremely bad” situation for the wider ecosystem. AI-assisted analysis was producing findings far faster than specialists could validate them, creating a growing queue of reports that could contain severe weaknesses alongside false positives and lower-risk coding errors.
The operation generated roughly 180 findings an hour across the team. Organisers said individual researchers were averaging about one potentially critical discovery per hour when actively reviewing AI output. Computing expenditure was running at about $10,000 a day, reflecting the heavy use of frontier models, automated agents and repeated testing needed to reproduce suspected flaws.
Funding of nearly $40,000 supported the opening phase of the project. OpenSats, a non-profit organisation that finances open-source Bitcoin development, backed the initiative after concerns intensified over vulnerabilities in software used to store and transact the cryptocurrency.
Software engineer Calle, who created an Android implementation of the decentralised messaging application Bitchat, and AnchorWatch chief executive Rob Hamilton have emerged as leading figures in the programme. AnchorWatch provides insurance services linked to Bitcoin self-custody.
The team began expanding its work following reports of security problems affecting Coldcard hardware wallets. Hardware wallets are designed to keep private keys away from internet-connected devices, but their security still depends on firmware, random-number generation, transaction handling and supporting applications.
Investigators are examining whether weaknesses in older wallet software may have exposed users to theft. The Red Team’s broader sweep was intended to determine whether similar flaws existed elsewhere rather than limiting the review to a single manufacturer or product.
Critical ratings carry particular weight in Bitcoin development. Within Bitcoin Core’s security framework, the category is generally reserved for defects that could threaten the integrity of the network, permit protocol-level coin theft, disrupt the issuance schedule or produce a permanent chain split.
The Red Team is auditing a much wider selection of repositories, however, meaning its internal severity labels may not correspond directly with Bitcoin Core’s definitions. A critical fault in a wallet, exchange library or payment application could endanger users of that product without threatening Bitcoin’s consensus system.
Responsible disclosure has therefore become central to the exercise. Researchers are attempting to reproduce serious findings locally before contacting maintainers and withholding technical details that could help attackers. Some open-source projects are maintained by small teams with limited resources, making rapid patch development difficult.
AI has changed the economics of software auditing by allowing researchers to inspect large codebases simultaneously. Tasks that once required weeks of manual examination can now produce thousands of leads within hours. The same acceleration creates risks because automated models may misunderstand code, exaggerate severity or generate duplicate reports.
Human review remains the main bottleneck. Researchers must determine whether vulnerable code can actually be reached, whether exploitation requires unusual settings and whether existing safeguards reduce the impact. They must also separate new discoveries from previously documented defects.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
