Bitcoin Red Team's AI-Assisted Review Unearths Thousands of Potential Security Flaws

The Bitcoin Red Team's AI-assisted review of open-source projects has produced a staggering 4,962 potential security findings. The team, consisting of 16 volunteers including developer Calle and AnchorWatch CEO Rob Hamilton, completed the review in just 30 hours using AI models to scan repositories for suspicious code.

The AI tools identified 85 possible critical flaws and 635 high-severity findings, with a rate of approximately 2.31 serious findings per volunteer each hour during the review. Calle reported that nearly one potential critical exploit per volunteer was discovered every hour.

However, researchers were only able to reproduce 21.4% of all reports, highlighting the need for human testing to separate signals from false alarms. The team used AI models to identify weak randomness, access errors, memory faults, and unsafe software interactions, but automated reviews can also generate false positives, duplicate reports, and issues that real systems cannot exploit.

The findings are particularly concerning in light of recent vulnerabilities discovered in Coldcard hardware wallet firmware versions, which allowed attackers to steal approximately 1,816 BTC from over 5,200 addresses. The weakness was attributed to a serious seed-generation flaw that weakened the randomness used to create some recovery seeds.