Bitcoin: An AI red team reveals 85 critical flaws

In 27 hours, 16 developers reported 4,962 issues across 390 Bitcoin-related projects, including 85 critical and 635 high severity flaws. Sixteen developers piloted the audit with AI models and about $10,000 of compute per day, but the volume mostly reveals a sorting problem. The priority now is to deal with bugs before attackers.

Bitcoin red team reports critical flaw almost every hour

On August 4, Calle, the pseudonymous developer associated with the Cashu protocol, launched a wave of offensive reviews, a red teaming approach that tests code as an attacker would.

According to Calle, the team was examining crypto libraries, wallets and Bitcoin infrastructure at a rate of approximately one critical exploit per hour per person, while he described the situation as “extremely bad.” After the recent turbulence of the Bitcoin network, this campaign appears as an audit of the ecosystem, not as the search for a single flaw.

As of August 5, the group had 16 members spread across the globe and was working around the clock. Its tally published on

The volume is impressive, but these figures must be read with caution. A report does not yet constitute confirmed exploitation. CoinDesk reports that project managers quickly verified most of the critical reports and replicated them in a local environment with a proof of concept.

The real bottleneck begins after discovery

The main problem is already no longer detection, but sorting, verifying and sending reports to the right maintainers. Rob Hamiltonwhich is building the group’s automated facility, summed up this difficulty: The real bottleneck is directing each alert to the right team.

The hardest part is coordinating sending reports to the right people.

This step is as important as the scan itself. A security team must distinguish a real bug from a false positive, establish a reproducible scenario, verify the impact, then give the maintainer enough information to correct without wasting time.

The group says it publishes quickly because officials can test reports with the same tools. However, this speed also increases the reception load and imposes strict prioritization.

In both cases, AI expands code coverage, but it does not replace judgment. The useful report is not the one that looks alarming, it’s the one that a maintainer can reproduce and process.

Risk exceeds Bitcoin when AI also accelerates attackers

The tool that expands defense can also reduce the cost of offensive research. CoinDesk recalls that Anthropic had found for less than $50 a flaw that no one had detected for 27 years in widely used software, while Google said it had spotted a criminal group preparing an attack around a flaw that a model had found.

The Bitcoin Red Team group burns around $10,000 a day to maintain this pace. This amount does not measure the cost of an actual attack, but it shows that computing power and human sorting now form a concrete budget item for the defense of crypto infrastructures.

The Coldcard precedent makes the risk tangible. The thefts that began on July 30 took up to $114 million from wallets whose seeds came from faulty firmware, according to CoinDesk. The case serves as a reminder that a bug can remain exploitable long after its discovery, especially when users do not know that they need to migrate their funds.

In short, the Bitcoin Red Team highlights three facts: AI models spot flaws at high speed, maintainers must absorb and qualify an avalanche of reports, and attackers can use the same methods. Tracking Coldcard Hack Losses is a reminder that users remain exposed after a team fixes a flaw, as long as they haven’t migrated their funds. This campaign does not prove that Bitcoin is compromised, but it does show that its security is now being played out at an industrial rate. Triage will make the difference.