Volunteer Red Team Says AI Audit Turned Up 85 Critical Bugs Across 390 Bitcoin Projects

A 16-person volunteer group running AI models against Bitcoin codebases has filed nearly 5,000 findings in about a day, overwhelming maintainers.

A group of 16 developers running AI models against Bitcoin wallets, cryptographic libraries and infrastructure has filed 4,962 security findings across 390 projects, including 85 critical and 635 high-severity issues, according to “Calle,” the pseudonymous developer behind the Cashu ecash protocol who is coordinating the campaign.

“Situation is extremely bad,” Calle said on X.

This story is an excerpt from the Unchained Daily newsletter.

The group, which calls itself the Bitcoin Red Team, at the roughly 27-hour mark was averaging 2.31 high or critical findings per person per hour, Calle said, adding that the rate was climbing as the team’s automated harnesses improved.

The disclosure volume has created a second problem. Calle apologized to maintainers overwhelmed by reports and said the team is still learning to separate real findings from noise, while saying that fast publication was necessary because others could find the same bugs. Rob Hamilton, who is building the automated setup, said the bottleneck is coordination rather than discovery, and described the current system as a first version.

The audit comes after the Coldcard hardware wallet exploit. Coldcard sweeps that began July 30 have drained over $100 million from user wallets. AI-driven discovery has already reshaped crypto security elsewhere: an AI-assisted audit of Zcash in June found a bug that could have minted unlimited counterfeit ZEC .

Related Listen: DEX in the City: How Claude’s Red-Teaming Agents Escaped a Test Without Realizing It