Bitcoin Red Team finds nearly 5,000 potential security flaws

The Bitcoin developer community has completed one of its largest security reviews ever, uncovering 4,962 potential vulnerabilities across 390 open-source Bitcoin projects.

The initiative, known as the Bitcoin Red Team, was launched after the recent Coldcard wallet vulnerability exposed weaknesses in Bitcoin security. The goal is to find software bugs before attackers can exploit them.

Out of the 391 codebases reviewed, only one project was found to have no security issues.

Related: We previously covered how the Bitcoin Red Team uncovered its first wave of critical vulnerabilities following the Coldcard wallet exploit. Read our earlier report: Bitcoin Red Team finds 85 critical security flaws after Coldcard hack

Bitcoin Red Team Found Hundreds of High-Risk Issues

The review identified vulnerabilities ranging from low-risk bugs to critical security flaws.

According to the team's report:

• 85 findings were classified as Critical.
• 635 findings were marked as High Severity.
• 1,386 findings were rated Medium.
• 1,723 findings were considered Low Severity.
• 869 findings were categorized as Informational.
• 246 findings have not yet received a severity rating.

Overall, 720 vulnerabilities were classified as either High or Critical, representing roughly 14% of all findings.

Most Findings Came From Automated Security Scans

The report also explains how the vulnerabilities were discovered.

Around 91% of all findings came from automated AI-powered security scanning, while roughly 21% included working proof-of-concept demonstrations showing how the issue could potentially be exploited.

The team says only eight reports were later dismissed as false positives, suggesting that most findings deserve further investigation.

So far, only 147 vulnerabilities have been reported directly to project maintainers, who are responsible for reviewing and fixing the issues.

The Headline Number Needs More Context

Although the report highlights nearly 5,000 findings in about 30 hours, the timeline deserves some explanation.

According to AnchorWatch CEO Rob Hamilton, more than 4,100 findings were uploaded during a single hour. These were not generated live but were part of an earlier security review completed before the public campaign officially launched.

Hamilton said he had already spent more than $10,000 auditing over 100 Bitcoin software libraries before joining the broader initiative.

Without that earlier batch of reports, the team discovered roughly 840 findings during the remaining hours of the campaign.

Crypto Libraries Had the Most Security Findings

One surprising result from the audit is that hardware wallets were not the biggest source of security problems.

Instead, the largest number of findings came from Bitcoin software libraries used by many applications.

The report found:

• Crypto libraries generated 1,385 findings across 128 projects.
• Mining pools recorded one of the highest percentages of serious issues.
• Infrastructure and developer tools also ranked among the highest-risk categories.
• Hardware wallets and firmware recorded one of the lowest rates of critical findings.

The researchers say this shows that security risks exist across the broader Bitcoin ecosystem, not just in hardware wallets.

Coldcard Incident Triggered the Security Review

The Bitcoin Red Team was formed shortly after Coinkite disclosed a serious vulnerability affecting some Coldcard hardware wallets.

The flaw allowed affected devices to generate wallet seeds using weak randomness under certain conditions.

Security researchers later estimated that attackers stole roughly 1,596 BTC from thousands of affected addresses. If additional suspected attacks are confirmed, total losses could approach $130 million.

The incident prompted developers to launch a much wider review of Bitcoin's open-source software to identify similar weaknesses before they can be exploited again.

OpenSats Launches New Security Funding Program

The audit has also attracted support from OpenSats, a nonprofit organization that funds Bitcoin development.

OpenSats recently introduced its Code RED grant program, which rewards researchers who responsibly report software vulnerabilities.

The initiative also helps cover the cost of AI-powered security tools used during large-scale code reviews.

Developers hope these incentives will encourage more researchers to identify security issues before they become real attacks.

What This Means for Bitcoin

The discovery of nearly 5,000 vulnerabilities does not mean Bitcoin itself has been compromised.

Most of the findings are potential software issues that still need to be reviewed by individual project maintainers. Many may never become real-world exploits.

However, the audit highlights how important ongoing security reviews have become as Bitcoin's software ecosystem continues to grow.

The recent Coldcard incident showed that even trusted projects can contain hidden vulnerabilities. By identifying these issues early, developers hope to strengthen Bitcoin's open-source infrastructure and reduce the risk of future attacks.