A volunteer group calling itself the Bitcoin Red Team has used AI models to audit 390 open source Bitcoin repositories, filing 4,962 vulnerability findings so far. The push began after hackers exploited a random-number-generator bug in Coldcard hardware wallets, and the nonprofit OpenSats has covered the AI costs behind the search.
The Bitcoin Red Team, a volunteer security effort, has flagged 85 critical and 635 high-severity vulnerabilities across 390 open source Bitcoin repositories in an AI-driven code audit. The push began after hackers exploited a random-number-generator bug in Coldcard hardware wallets, draining over $100 million from bitcoin holders.
Volunteers turn AI on Bitcoin's codebase
Software engineer Calle and Rob Hamilton, chief executive of self-custody insurer Anchorwatch, lead the effort. The nonprofit OpenSats has covered over $40,000 in AI token costs so the team can run large language models against Bitcoin's open source stack. Early access to OpenAI and Anthropic models was limited, pushing the team toward Chinese open-source models; connections established since the Coldcard hack have confirmed access to GPT Sol, and Hamilton's mention of Fable suggests Anthropic access has also been established, alongside Kimi K3, Opus and GLM5.2.
A custom harness speeds up the hunt
The team built a harness of 171,599 lines of code to identify high-load-bearing Bitcoin software, document vulnerabilities, reproduce them and package the findings for engineers. Hamilton said Red Team intends to open source the harness so Bitcoin companies can run it against their own closed-source code. In 27.5 hours of work, the team logged 4,962 findings across the 390 projects reviewed so far, a pace of 2.31 high-and-critical findings per person per hour.
Boltz pauses as disclosures rattle the industry
Boltz exchange paused operations to catch up with AI-driven hacking attempts after the Coldcard losses. Hamilton framed the Coldcard exploit as an attack on Bitcoin's self-custody principles, and his closing message carried a warning: "There is no Bitcoin without self-custody. This is non-negotiable."
Source: Bitcoin Magazine
Trading involves risk.
Risk Disclaimer
