'Extremely Bad': Bitcoin Red Team Flags 85 Critical Bugs in About a Day

Bitcoin developers file thousands of AI-found flaws

A volunteer group of 16 Bitcoin developers used artificial intelligence (AI) tools to review the network's software and filed 4,962 security findings across 390 projects in a little over a day. The effort, known as the Bitcoin Red Team, pointed AI models at wallets, cryptographic libraries and infrastructure projects rather than a single codebase. Developers steered the models and reviewed what they returned. Calle, the pseudonymous developer behind the Cashu ecash protocol, reported the totals and said the group is averaging about one critical bug per person each hour.

Audit flagged 85 critical and 635 high-severity bugs

Of the 4,962 findings, 85 were rated critical and 635 high-severity, according to the group. Running the AI models costs close to $10,000 per day in compute. Project owners confirmed most of the critical reports, and researchers rebuilt working proofs of concept in local test environments before alerting maintainers. The group plans to release the security harness it built for the review, according to reports. Calle described the ecosystem in blunt terms, calling the situation "extremely bad."

"There's a lot of chaos right now in the ecosystem", 6 August 2026. — Calle, developer, Cashu ecash protocol

Backers covered compute and model access

The volunteer effort drew outside support. According to crypto.news, the non-profit OpenSats covered the computing bill, while AI developer Moonshot provided model access, including its Kimi K3 system. That funding let the team run the models continuously rather than absorb the full compute cost themselves. The same report said 21.4% of the filed issues had already been reproduced by the time the group shared its totals, the step that separates confirmed bugs from false positives.

A dormant Coldcard firmware bug triggered the review

The audit followed a wave of thefts tied to the Coldcard hardware wallet. According to CoinDesk, the Coldcard sweeps began on 30 July and have taken as much as $114 million from wallets whose seeds were generated by faulty firmware. Separate on-chain estimates cited by crypto.news put the drained total near 1,596 BTC from roughly 7,300 addresses. The underlying bug had sat dormant since 2021. The losses prompted developers to check whether similar flaws were hiding in other widely used Bitcoin software.

Verification now outpaces discovery, developers say

Developers said finding flaws is no longer the hard part. As AI lowers the cost of discovery, verifying each report and routing it to the correct maintainer has become the bottleneck. Rob Hamilton, chief executive of AnchorWatch, is building an automated setup to move confirmed issues to the right teams. He said the setup works but described it as "only version one." The race, developers said, is to reach maintainers before attackers exploit the same flaws.

"The hardest part is coordinating to get things to the right people", 6 August 2026. — Rob Hamilton, Chief Executive, AnchorWatch

Bitcoin traded near $64,000 during the audit

Bitcoin (BTC) traded at $64,116 at the time of publication, down 0.4% over the past 24 hours against the previous close (CoinPaprika, 6 August 2026). The asset has fallen about 49% from its October 2025 record high near $126,000 (CoinPaprika, 6 August 2026), and its market value stood near $1.29 trillion. Trading volume over the prior 24 hours was near $17.9 billion (CoinPaprika, 6 August 2026). The review targeted ecosystem software — wallets, cryptographic libraries and infrastructure — and did not report a flaw in Bitcoin's base protocol.