The artificial intelligence analyzed 390 open-source Bitcoin projects in just 27.5 hours. The system identified 4,962 potential security issues, including 85 classified as critical and 635 as high risk. The results do not yet amount to confirmed vulnerabilities, but the scale of the experiment shows how quickly AI is changing the way security audits are conducted in the Bitcoin world.
Behind the operation is the Bitcoin Red Team, which used several advanced AI models to massively review the code of open source projects. According to information published by Coinsauce, the analysis cost over PLN 40,000. USD in computing power, and financing was provided by OpenSats.
The most important caveat concerns the results themselves. The number 4,962 does not mean that there are actually thousands of active vulnerabilities in the Bitcoin ecosystem. AI models may generate false positives, so reports must still be checked by specialists. Only after this verification will it be known how many problems are real and which of them may have practical significance for users.
Bitcoin Red Team update: we’ve grown to 16 globally distributed people working 24/7 We’re running a large-scale ecosystem security audit across bitcoin code bases. 27.5 hours in, we’ve filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues. We’re at
390 projects checked in just over 24 hours
The scale of the operation is important primarily due to time. A traditional security audit of one extensive project may involve specialists for many days or weeks. Here, in just over 24 hours, hundreds of repositories covering various elements of Bitcoin-related infrastructure were analyzed.
AI plays the role of the first line of analysis in such a model. It can review huge amounts of code, compare its versions, detect unusual fragments and indicate places that should then be checked by a human. This does not eliminate the need for manual auditing, but it can dramatically reduce the area that requires detailed expert work.
The system marked 85 finds as critical and another 635 as high risk. At this stage, these numbers should be considered a classification generated by the scan and not a confirmation of the existence of specific exploits.
The impetus was the well-known Coldcard vulnerability
The consequences turned out to be serious. Initial reports indicated approximately $38 million in bitcoin was withdrawn from affected wallets. Later estimates increased, and according to data cited by the media, the value of the seized BTCs was to exceed USD 100 million.
Even more important in the context of the current experiment is how the vulnerability could have been found. Coinkite suggested that the attacker may have used AI to analyze earlier versions of Coldcard’s public firmware. This is a scenario that is difficult to confirm unambiguously, but the fact that the manufacturer takes it into account clearly demonstrates the change taking place in cybersecurity.
Open source code has always been accessible to both bona fide bug finders and would-be attackers. AI does not fundamentally change this principle. However, it changes the rate at which such code can be analyzed.
AI can protect Bitcoin, but attackers have the same tools
Code openness is one of the foundations of the Bitcoin ecosystem. It enables independent software control, audits and bug detection by the community. Until recently, however, scale was a barrier. Manually reviewing thousands of changes across multiple repositories required a lot of expertise and a huge amount of time.
AI models can significantly reduce this barrier. A potential attacker can automatically analyze subsequent versions of the code and look for errors in key generation, transaction signing, cryptography, memory or data validation. Tasks that previously required long team work can increasingly be performed automatically.
However, the same advantage works on the defenders’ side. If projects start regularly running their code through several independent AI models, some vulnerabilities may be found even before a new version is released or immediately after a risky change occurs. Bitcoin Red Team shows that this approach can be applied not only to one project, but also to a large part of the ecosystem.
Were 85 critical vulnerabilities really found?
It’s impossible to say for now. The system has marked 85 cases as critical, but each of them requires manual verification. Language models and AI-based tools may misinterpret code context, bypass existing protections, or classify as a vulnerability something that in practice gives the attacker no advantage.
With thousands of reports generated, the number of false positives can be significant. For this reason, the team is now tasked with checking the detected issues and providing information to the developers of the projects that are actually affected by the vulnerabilities. Only later can you expect responsible disclosure of details.
This stage will be the most important test of the entire experiment. If it turns out that even some of the 85 most serious reports constitute real and exploitable vulnerabilities, it will be a strong argument for the regular use of AI in audits of Bitcoin’s open-source infrastructure.
Cost 40 thousand USD may look completely different after Coldcard
Over 40 thousand USD spent on computing power sounds like a high cost for one experiment, but the benchmark changes after incidents like Coldcard. If a single vulnerability can lead to the loss of tens of millions of dollars of bitcoin, the economics of preventive audits start to look different.
In practice, similar systems would not have to analyze the entire code from scratch every time. You can imagine a model in which AI tracks new commits, library updates and subsequent software versions, and then re-analyzes only the changed fragments. The most suspicious cases would go to a human.
In such a scenario, a security audit is no longer a one-off event performed every few months. It becomes a continuous process, operating in parallel with the development of the project.
Open source can benefit from this
Coldcard’s story might lead you to the simple conclusion that public code is more vulnerable to attacks when you can run it through AI models and automatically look for bugs. However, this would only be partially true.
Attackers can indeed analyze public repositories, but developers, independent security researchers and organizations funding open source software have exactly the same access. The easier it becomes to automatically find vulnerabilities, the more important a role regular auditing of the entire ecosystem can play, rather than checking individual applications only after an incident.
This is particularly important in the case of Bitcoin, where many wallets and services use common libraries or similar components. An error in one of the core elements can impact multiple projects, so the ability to review hundreds of repositories in parallel has much more value than simply speeding up a single audit.
Bitcoin security is entering a new stage
The most important result of Operation Bitcoin Red Team today is not the number of 4,962 potential issues or the 85 tickets marked as critical. This data still needs to be verified. Much more significant is the fact that hundreds of projects can now be analyzed in hours, not months.
This could change the way both security teams and attackers operate. Some will use AI to find errors before they lead to losses, others will try to discover the same errors earlier. After the Coldcard incident, this is no longer an abstract discussion about the future of cybersecurity.
Now the most important thing will be how many of the problems detected by the Bitcoin Red Team will pass manual verification. If these include real high- or critical-risk vulnerabilities, mass AI audits could quickly become a permanent element of the security of the entire Bitcoin ecosystem.
