Bitcoin Red Team finds 85 critical security flaws after Coldcard hack

The Bitcoin community is taking action after the recent Coldcard hardware wallet exploit that led to the theft of more than $100 million worth of Bitcoin.

A new security group called the Bitcoin Red Team has already found 85 critical vulnerabilities and 635 high-severity issues while reviewing nearly 390 open-source Bitcoin projects.

The project uses advanced AI models together with experienced security researchers to identify software bugs before hackers can exploit them.

Related: Everything You Need to Know About the Coldcard Bitcoin Wallet Hack

Why the Bitcoin Red Team Was Created

The project started after the Coldcard wallet vulnerability exposed a serious weakness in Bitcoin security.

The exploit was linked to a flaw in the wallet's random number generator (RNG), allowing attackers to steal Bitcoin from affected wallets.

Users who have not moved their Bitcoin to wallets created with updated firmware are still at risk. The incident pushed developers and security experts to launch a large-scale review of Bitcoin's open-source software.

AI Finds 85 Critical Bitcoin Security Bugs

The Bitcoin Red Team is led by software engineer Calle and AnchorWatch CEO Rob Hamilton.

Since the project began, the team has reviewed almost 390 repositories used across the Bitcoin ecosystem.

In one of the latest updates, Calle said the team had reported:

• 4,962 security findings
• 85 critical vulnerabilities
• 635 high-severity issues

The team says it continues to discover new issues as more Bitcoin projects are reviewed.

AI Tools Power the Security Review

The audit combines artificial intelligence with human security experts.

The team uses several advanced AI models, including GPT Sol, Kimi K3, Fable, Opus, and GLM 5.2. These tools scan Bitcoin code, identify possible vulnerabilities, and generate detailed security reports.

Human researchers then verify the findings before contacting developers. According to the team, combining AI with experienced engineers produces better results than using either one alone.

OpenSats Funds the Bitcoin Security Project

The project has already spent more than $40,000 on AI computing resources.

The funding comes from OpenSats, a non-profit organization that supports open-source Bitcoin development. The Red Team is also building a custom testing platform that automatically scans Bitcoin software for security risks.

In the future, the team plans to release this testing tool as open-source software so Bitcoin companies can use it to test their own code.

Developers Are Already Fixing Security Issues

The Bitcoin Red Team is privately contacting developers whenever it discovers a serious vulnerability.

This responsible disclosure process gives projects time to fix security problems before hackers can exploit them. Several Bitcoin developers have shared humorous posts on social media about receiving unexpected messages from the Red Team, but the goal is serious.

The team wants to strengthen Bitcoin's software before another major attack can happen.

Security Experts Say Human Review Still Matters

Although AI performs most of the initial scanning, the team says human expertise remains essential. Some security issues require deep knowledge of Bitcoin's code and cannot be fully understood by AI alone.

Rob Hamilton said experienced engineers often recognize subtle problems that automated tools may miss. He believes the best results come from combining artificial intelligence with human judgment.

Bitcoin Self-Custody Remains a Top Priority

Following the Coldcard exploit, Hamilton described the attack as a major challenge for Bitcoin's self-custody model.

Despite the recent losses, he said the community remains committed to protecting Bitcoin users. He also stressed that secure self-custody remains one of Bitcoin's most important principles.

The ongoing security review aims to make Bitcoin's open-source software safer and reduce the risk of similar attacks in the future.