Bitcoin Red Team Finds 6,700 Issues in 55 Hours, But True Value Remains Unclear

A recent AI-assisted security campaign focused on the Bitcoin ecosystem, known as Bitcoin Red Team, reported finding 6,700 issues in just 55 hours. The campaign scanned a total of 425 projects and labeled 1,029 of the findings as high or critical.

The campaign's output was impressive, but its true value remains unclear due to missing data on validation rates and fix rates. In their first update, Bitcoin Red Team reported that 19.5% of scanned projects had a SECURITY.md file and 13.1% had an email there.

Rob Hamilton, the developer behind the campaign, described how AI systems can quickly fill an ecosystem-scale review pipeline, but emphasized that expert prompting, reproduction, disclosure, and maintainer response remain necessary at every stage.

The campaign's findings have sparked debate about their validity and the potential for false positives. Some experts have questioned whether the campaign could effectively triage its output, while others have praised the speed and efficiency of the AI-assisted review process.