Bitcoin Red Team Says AI Audit Found More Than Dozen Vulnerabilities Across 150 Repositories

Bitcoin Red Team Reports More Than a Dozen AI-Assisted Disclosures

The project calls itself a red team, a security practice in which researchers test software from an attacker’s perspective before a malicious actor can exploit a weakness. Hamilton said the work covered “load-bearing portions” of the Bitcoin ecosystem, but did not define which repositories met that description.

Developer Calle, another participant, said the reviews targeted crypto libraries, wallets and infrastructure. He also described the exercise as finding roughly one critical issue per person per hour, a rate that cannot be independently assessed while the reports remain confidential.

The group is using AI for initial code review and supporting documentation, according to the posts. That can speed up searching a large codebase, but a model output is not itself proof of a working exploit. Maintainers still need to reproduce the issue, judge its severity and decide whether a patch is warranted.

The reported scale gives the update search relevance because Bitcoin software sits beneath wallets, exchanges and self-custody tools. The immediately actionable fact is narrower: more than a dozen disclosures have reportedly been made, not that every scanned project or Bitcoin user is exposed.

No New Theft or Affected-Wallet Count Was Disclosed

Daily Crypto Briefs performed a loss-impact check for this report. The audit update did not name a compromised project, specify an attack wave, identify victims, provide transaction evidence or publish a loss amount. No new evidence reviewed linked the AI review itself to a theft.

That distinction is important after the separate Coldcard incident. Our confirmed Coldcard-loss report tracked 1,596 BTC stolen from roughly 7,300 addresses in a seed-generation failure, based on a Galaxy Research estimate. Those reported losses predate this audit update and should not be attributed to the Bitcoin Red Team’s unpublished findings.

The team has not said whether any of its disclosures concern a flaw with comparable user risk. Its members’ descriptions use the word critical, but severity labels depend on the affected code, reachable attack path, default settings, user behavior and whether a fix is already available.

The absence of public technical detail is normal during coordinated disclosure, but it also means holders should not react by moving funds solely because a broad audit has been announced. Rushed recovery-phrase imports and unverified “security tools” can create a new compromise path.

The broader security backdrop has been moving quickly. Daily Crypto Briefs recently covered how a major AI-model suspension highlighted DeFi exploit risk, while the Coldcard episode showed why a validated issue and documented on-chain losses are different stages of a security story.

Open-Source Audit Harness Is the Next Concrete Bitcoin Security Test

Hamilton said the team wants to open-source its harness so organizations can point it at non-public repositories. The stated goal is to automate more of the intake, review and report-handoff process, although the group said communication with the right maintainers remained a bottleneck.

That plan could widen review capacity for open-source Bitcoin software, but adoption, code quality and disclosure practices will determine its value. The group did not announce a release date, license, repository, funding amount beyond the reported spend or a public process for tracking completed remediations.

For maintainers, the next meaningful evidence will be a named advisory, a patch, a changelog entry or a coordinated disclosure from an affected project. For users, the relevant checks are official releases from the products they actually run, checksum verification and the same caution around seed phrases outlined in our hardware-wallet security coverage.

The reported audit does not alter Bitcoin’s consensus rules or establish a new system-wide exploit. What it does show is a group attempting to use AI to accelerate review of security-sensitive Bitcoin code, with its central claims still dependent on disclosures that have not yet been made public.