A volunteer group calling itself the Bitcoin Red Team has filed 4,962 security findings across 390 Bitcoin projects in approximately 30 hours, conducting what it describes as a "large-scale ecosystem audit" powered largely by AI agents. The effort dwarfs typical cryptocurrency security reviews, which are generally commissioned by a single project from firms such as Trail of Bits, Cure53, or Halborn and scoped to specific codebases over weeks or months rather than swept across hundreds of repositories in a single day.

Pseudonymous developer calle, creator of the Bitcoin ecash protocol Cashu, published the campaign's first situation report on Wednesday. The report classifies 85 findings as critical severity and 635 as high severity—together accounting for 14.5% of the total corpus. This translates to an average of 1.85 serious issues per project, filed at a rate of 166 findings per hour. Calle said the team has expanded to 16 people working around the clock, with the report logging 17 contributors in total: 14 human and three automated.

Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7 We're running a large-scale ecosystem security audit across bitcoin code bases. 27.5 hours in, we've filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues. We're at… pic.twitter.com/iRCylprbY1 — calle (@callebtc) August 5, 2026

Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7

We're running a large-scale ecosystem security audit across bitcoin code bases.

27.5 hours in, we've filed 4,962 findings across 390 projects.

85 critical and 635 high severity issues.

We're at… pic.twitter.com/iRCylprbY1

— calle (@callebtc) August 5, 2026

Much of the work remains manual, involving "hand holding the AI," calle wrote, though automated harnesses are improving. According to the report, 91% of findings were captured through automated scan intake. Calle noted that allowing each contributor to use their own preferred review method "has proven to be the most effective strategy," because contributors prompt their agents differently and surface different bugs. Approximately 21% of findings have been dynamically reproduced with proof-of-concept code. AI-assisted code analysis has become increasingly common in software development workflows, but its systematic application across an entire cryptocurrency ecosystem—and the resulting volume of disclosures—puts pressure on a norm that has relied on coordinated, project-by-project responsible disclosure.

Severity Distribution by Category

The severity distribution varies significantly across project categories. Privacy and coinjoin tools produced the highest proportion of high-or-critical findings at 24%, followed by swaps and exchanges at 21% and payments and merchant tools at 17%. Cryptographic libraries and SDKs generated the largest raw volume at 1,101 findings, though only 10% reached the high-severity threshold.

Maintainers Under Pressure

Only 19 projects—fewer than 5% of those reviewed—have had findings disclosed upstream so far. Calle acknowledged that the campaign is adding to an already challenging moment for project maintainers, many of whom oversee codebases with small contributor bases and limited dedicated security budgets—a structural issue long documented across open-source cryptocurrency infrastructure.

"We're sincerely sorry if our reports added stress to your already stressful day," he wrote. He argued that findings should be released quickly because project owners are best positioned to validate them, validation is now nearly free with AI assistance, and anyone else deploying the same tools will arrive at the same conclusions. Eight findings have been retired as false positives. The backlog of undisclosed findings across the remaining 95% of projects raises practical questions about triage timelines and whether maintainers can absorb the volume before third parties replicate the same results independently.

The Coldcard Backdrop

The campaign comes at a time when Bitcoin's security assumptions face heightened scrutiny. Coinkite's Coldcard wallet resulted in approximately $130 million in user losses after a March 2021 firmware build generated wallet seeds from a software fallback rather than the device's hardware random number generator, rendering private keys guessable. In a post-mortem, the firm noted it was likely that "someone used AI to review previous versions of our firmware."

Ledger chief technology officer Charles Guillemet told Decrypt on Tuesday that the incident demonstrated AI is now being used to identify vulnerabilities in cryptocurrency code "at machine speed." He added that "open source and reviewed are not the same thing," noting that the Coldcard flaw remained in public code for more than five years until an adversary reportedly leveraged AI to uncover it. Defense, he argued, must now match the speed of attackers—as groups like the Bitcoin Red Team are demonstrating.