16 volunteers, 5,000 bugs, zero chill: Bitcoin Red Team's AI audit goes brrr 🪲

A volunteer Bitcoin security collective operating with just 16 members has flagged nearly 5,000 potential vulnerabilities across projects in the Bitcoin ecosystem during a rapid, AI-assisted review of open-source repositories. Bitcoin Red Team, which includes AnchorWatch CEO Rob Hamilton and Bitcoin developer Calle, is combining AI tooling with human review to scan Bitcoin-related code for flaws, with Calle posting to X on Wednesday that the group is "averaging on the order of 1 critical exploit per hour per person."

The audit push launched days after the reported Coldcard hardware wallet hack, an incident tied to the theft of more than $100 million in $BTC. According to Calle, in the first 29.8 hours of operation the team logged 4,962 potential issues spanning 390 projects, with as many as 720 classified as high- or critical-severity findings. Roughly 21.4% of those findings have been reproduced so far, Calle said.

Bitcoin Red Team is built around volunteer contributors rather than a formal corporate structure, and the group's findings are being shared publicly as the audit progresses. Related reporting from Galaxy has indicated that at least 15 attackers exploited the Coldcard vulnerability, underscoring the scope of recent risks in Bitcoin self-custody tooling.

The group has not disclosed funding, compensation for participants, or a timeline for completing the broader review, and Calle did not identify which specific projects contain the highest-severity issues. $BTC price action was not addressed in the post, and the team has framed the effort strictly as a security exercise rather than an investment recommendation.

The campaign's early numbers place it among the more concentrated open-source security sweeps in the Bitcoin ecosystem to date, measured by findings per volunteer-hour. Bitcoin Red Team said it will continue publishing results as reviews progress across the 390 projects already indexed.