Bitcoin Red Team Uncovers Nearly 5,000 Potential Vulnerabilities Across Bitcoin Projects

Highlights:

• Bitcoin Red Team found nearly 5,000 potential security issues across hundreds of Bitcoin projects.
• Researchers privately shared critical vulnerabilities with developers before making the findings public.
• The Coldcard wallet flaw pushed more Bitcoin developers to strengthen software security reviews.

Bitcoin Red Team, a volunteer Bitcoin security initiative, has identified 4,962 potential security issues after reviewing 390 Bitcoin-related open-source projects in about 30 hours. The initiative brings together 16 volunteers, including Bitcoin developer Calle, AnchorWatch CEO Rob Hamilton and other Bitcoin contributors. The review examined wallet software, cryptographic libraries, infrastructure software and other open-source Bitcoin projects for security vulnerabilities.

Nearly 5,000 hidden vulnerabilities uncovered across the BTC ecosystem

Following the shocking ColdCard wallet hack, Bitcoin Red Team — a group of 16 volunteer security researchers — used AI to re-audit the source code of 390 projects across the Bitcoin ecosystem.

The results:… pic.twitter.com/AOU86XGFhV

— Raven Thesis (@VuKkhaiMinh1301) August 6, 2026

The volunteers used AI-assisted tools and manual testing to identify potential security weaknesses across hundreds of Bitcoin software projects. Researchers identified 85 potential critical vulnerabilities and 635 high-severity security findings during the initial review. The review identified 85 potential critical issues and 635 high-severity issues, bringing the total number of serious findings to 720.

The team successfully reproduced 21.4% of the reported issues to confirm that the findings reflected genuine software weaknesses. Researchers are still testing the remaining findings because AI-generated reports require manual verification before developers classify them as exploitable vulnerabilities. Calle described the current state of Bitcoin software security as “extremely bad” after reviewing hundreds of repositories.

Calle said the team privately disclosed several critical vulnerabilities to affected project maintainers within the previous 12 hours so they could prepare fixes. The researchers have not identified the affected Bitcoin projects publicly because developers are still preparing security fixes. Instead, the team privately notified project maintainers to give them time to release security patches before public disclosure.

Bitcoin Red Team Steps Up Security Checks

Bitcoin Red Team uses AI models to inspect large amounts of code across Bitcoin projects much faster than traditional manual audits. The campaign reviews wallet software, cryptographic libraries, infrastructure software and other open-source Bitcoin repositories for security flaws. AI models identify suspicious code, highlight possible attack paths and flag software that may contain security vulnerabilities.

The AI system searches for weak randomness, unsafe assumptions, memory problems, access-control flaws and unexpected interactions that attackers could exploit. However, researchers verify every important finding before determining whether attackers can exploit it. Manual verification removes false positives and duplicate reports before the team notifies affected developers.

Calle said the volunteers averaged about 2.31 high- or critical-level findings per person each hour. He also estimated roughly one potential critical exploit per volunteer each hour during part of the campaign.

The team developed custom testing harnesses that automate code analysis and support manual security verification. OpenSats is funding the campaign’s AI computing costs, which currently total about $10,000 each day. The wider AI-assisted review has already consumed more than $40,000 in computing resources during the campaign. The team plans to release its custom testing framework as open-source software so developers can review both public and private Bitcoin code.

Coldcard Flaw Raises New Security Concerns

The Bitcoin Red Team expanded the wider security review after attackers exploited a vulnerability in Coldcard hardware wallet firmware. Galaxy Research confirmed that attackers stole 1,596 BTC from about 7,300 wallet addresses during three confirmed attack waves. Researchers are also investigating a suspected fourth coordinated attack wave that could increase total losses to about 2,055 BTC.

🚨LOSSES FROM COLDCARD HACK EXCEED $100M

High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.

If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).

More in the thread below 👇 pic.twitter.com/RAl3ib67qa

— Galaxy Research (@glxyresearch) August 3, 2026

Investigators found that about 90% of the stolen Bitcoin has remained in attackers’ wallets without moving on the blockchain. However, blockchain analysts recently observed another attacker routing 64 BTC through a Bitcoin mixer to hide transaction activity. The largest known attacker still holds 1,159 BTC across seven wallet addresses without moving the funds.

Coinkite traced the vulnerability to a firmware update introduced in March 2021 while integrating a new cryptographic library. The firmware update generated wallet seeds with a deterministic pseudo-random generator instead of the intended STM32 hardware random-number generator. Coinkite released emergency firmware updates for all affected Coldcard devices after confirming the weakened seed-generation process.