Bitcoin Red Team Unleashes AI-Powered Security Audit Blitz on 390 Projects

A large-scale security audit campaign using AI agents has filed 4,962 findings across 390 Bitcoin projects in just 30 hours. The 'Bitcoin Red Team' campaign, led by pseudonymous developer calle, creator of the Cashu protocol, aims to identify vulnerabilities in Bitcoin codebases. According to the first situation report, the team logged 85 critical and 635 high-severity issues, with an average of 1.85 serious issues per project.

The campaign uses a unique approach, where contributors each prompt their own agents, producing a wider spread of hits than a single method would. This has led to a higher number of findings, with 91% arriving through automated scan intake. The severity spread varies sharply by category, with privacy and coinjoin tools returning the highest proportion of high-or-critical findings at 24%.

The campaign lands as Bitcoin's security assumptions come under scrutiny, following the March 2021 firmware build incident that led to a $130 million loss for Coinkite's Coldcard wallet users. Ledger chief technology officer Charles Guillemet noted that AI is now being used to identify vulnerabilities in crypto code 'at machine speed', and defence has to move at the same speed as attackers.