A volunteer group called the Bitcoin Red Team ran an AI-assisted emergency audit of the open-source Bitcoin ecosystem after the Coldcard hardware-wallet RNG exploit. In 27.5 hours, between August 4 and 5, it filed 4,962 security findings across 390 open-source Bitcoin repositories. Of those, 85 were classified critical and 635 high severity.
The group is led by pseudonymous Bitcoin developer Calle, creator of the Cashu protocol, and AnchorWatch CEO Rob Hamilton. It is funded by OpenSats. Findings were responsibly disclosed to project owners. The audit followed a Coldcard firmware RNG vulnerability, dating to March 2021, that drained over $100 million from wallets. Outlets put the total loss between roughly $70 million and $120 million.
Forbes described the situation as "extremely bad". The audit is ongoing and coordinated across projects. The total count of findings, the number of repositories, and the severity breakdown were reported consistently across the outlets that covered the story.
Decrypt; Bitcoin Magazine; Bitcoin.com; CryptoBriefing; Blockonomi