Bitcoin Red Team Unleashes Torrent of Security Findings with AI-Powered Audit

A volunteer group called the Bitcoin Red Team has conducted a large-scale security audit of 390 Bitcoin projects using AI agents, uncovering 4,962 findings in just 30 hours. The campaign focused on both automated and manual scanning methods, with contributors prompting their own agents to produce a wider range of hits. According to the group's report, the majority of serious findings came from privacy and coinjoin tools, which accounted for 24% of high-or-critical issues.

The project, led by Cashu creator calle, utilized AI-powered scanning methods that allowed contributors to prompt their own agents, producing a more comprehensive range of results. The group reported that around 21% of findings were dynamically reproduced with proof-of-concept code, and only 19 projects have had findings disclosed upstream so far.

The campaign comes at a time when Bitcoin's security assumptions are under scrutiny following the recent Coldcard wallet exploit, which resulted in losses of over $130 million. Ledger's chief technology officer Charles Guillemet noted that AI is now being used to identify vulnerabilities in crypto code 'at machine speed', highlighting the need for defenders to move at the same pace as attackers.