A volunteer Bitcoin security initiative has identified 4,962 potential vulnerabilities across 390 projects during its first 29.8 hours of AI-assisted code reviews, including 720 findings rated high or critical.
The Bitcoin Red Team began a coordinated review of open-source Bitcoin software after recent attacks involving Coldcard hardware wallets. The campaign covers libraries, wallet applications, infrastructure software and other components used across the Bitcoin ecosystem.
Bitcoin developer Calle said the group was “averaging on the order of 1 critical exploit per hour per person” and had privately reported critical vulnerabilities to several projects during the preceding 12 hours. He described the overall security position as “extremely bad.”
The initiative is being carried out by volunteers, including AnchorWatch CEO Rob Hamilton, who are combining artificial-intelligence tools with manual checks to assess potential weaknesses.
Data published by Calle shows that the team has completed automated and human-led reviews of 390 repositories. Of the 4,962 potential issues identified, 720 have been given a high or critical severity rating.
The group said 21.4% of the reported issues had already been reproduced. That figure indicates that more than one-fifth of the initial findings generated with AI assistance have so far been independently verified.
Rather than examining one product, the campaign is looking across the wider Bitcoin software environment. Its targets include cryptographic libraries, wallet software, infrastructure components and other open-source projects.
Calle said the team was using several testing harnesses built specifically for the operation. The work is costing about $10,000 (£7,500) a day in computing expenses, with OpenSats paying the bill. Kimi Moonshot has also provided AI accounts and access to its Kimi K3 model.
The organisers have appealed to members of the Bitcoin community for additional computing accounts or digital tokens to help keep the review running.
Coldcard attacks prompt wider investigation
The security campaign began less than a week after attackers exploited a weakness in firmware used by vulnerable Coldcard hardware wallets. The incident has led Bitcoin developers and security researchers to increase scrutiny of related software.
Galaxy Research has confirmed that 1,596 BTC were stolen from about 7,300 addresses across three known attack waves. It also found 14 smaller incidents associated with the same Coldcard seed-generation flaw.
The research firm has identified what it believes may be a fourth coordinated wave. If confirmed, it could take the overall losses to about 2,055 BTC. Those addresses have not yet been added to Galaxy’s confirmed total because further confirmation from victims is still required.
Earlier blockchain analysis by Galaxy estimated that the suspected fourth wave involved 448.7 BTC moving from 709 likely victim addresses. The firm cautioned, however, that blockchain evidence alone cannot conclusively establish every victim or demonstrate that all of the thefts were carried out by a single operator.
Around 90% of the stolen Bitcoin has remained where it was. Analysts also reported separate on-chain activity in which another attacker began routing 64 BTC through a Bitcoin mixer. The largest known attacker continues to hold 1,159 BTC across seven addresses without moving the funds.
Firmware flaw affected seed generation
Coinkite said the Coldcard vulnerability was introduced during a firmware change in March 2021, when the company was integrating a new cryptographic library.
Instead of using the intended hardware random-number generator to create wallet seeds, affected firmware versions used a deterministic pseudo-random generator supplied by MicroPython.
Block’s Bitcoin engineering and security team reached the same conclusion in an independent firmware review. Although Block said it had not carried out empirical testing on every affected device, it found that vulnerable firmware called the deterministic fallback rather than the STM32 hardware random-number generator during seed creation.
Coinkite estimates that affected Mk2 and Mk3 devices generated about 40 bits of effective entropy. Vulnerable Mk4, Mk5 and Coldcard Q devices produced approximately 72 bits, rather than the intended 128 bits.
Emergency firmware updates have been issued for all affected products. Coinkite has warned that updating the firmware does not make wallets created with vulnerable versions safe.
Users are required to generate completely new seed phrases on updated devices and move their Bitcoin to addresses created from those new seeds. Wallets generated using at least 50 private dice rolls are not considered vulnerable to this particular random-number-generation problem alone, although Coinkite still recommends that users migrate their funds.
The Bitcoin Red Team said its work would continue while the Coldcard investigation remains active. It has continued to send newly discovered vulnerabilities privately to affected projects, allowing maintainers time to develop fixes.
The group has not named the projects involved in the latest critical disclosures. Reviews are continuing across additional Bitcoin repositories, with human verification remaining a necessary stage before potential vulnerabilities are formally reported.
