Red Team finds 85 critical flaws in 390 bitcoin projects
Sixteen volunteers scanned 390 open-source projects from the bitcoin ecosystem in 27.5 hours and filed 4,962 findings, of which 85 critical and 635 high. This is not the bitcoin protocol itself, but the tooling around it. The trigger was the Coldcard incident.
After the theft through Coldcard wallets, a group of security researchers set about examining the rest of the bitcoin ecosystem. The result of that sprint, completed on 5 August 2026, is substantial: in 27.5 hours of active time, 390 open-source projects were scanned and 4,962 findings filed. Of those, 85 are rated critical and 635 high. Sixteen volunteers took part, a rate of 2.31 high or critical findings per person per hour.
One caveat straight away: this is not about the bitcoin protocol. It is about the layer around it — libraries, wallet software, node tooling, payment integrations. Precisely the code most people pass through daily without giving it a thought.
How they did it
The Bitcoin Red Team is led by Calle, a software engineer and the creator of Bitchat, and Rob Hamilton, chief executive of Anchorwatch. The group built its own harness of 171,599 lines of code and used it to run a series of AI models across the repositories, among them Kimi K3, GPT Sol, Fable, Opus and GLM5.2. Findings were reproduced locally before being reported, which is the difference between a usable report and a pile of false alarms.
OpenSats, the foundation that funds open-source bitcoin development, covered the costs: over 40,000 dollars (roughly €35,000) in AI usage. The group had previously reviewed some 150 repositories with more than ten private disclosures; this sprint is the scaled-up version.
Reports go directly to the maintainers of the projects concerned, under the usual responsible-disclosure conventions. No list of project names has been published, deliberately. The group intends to open-source the harness itself so companies can hold their own closed code to the same standard.
The other side of it
There is an uncomfortable edge to this story. The same models that find 85 critical flaws in just over a day can be pointed at the same code by someone else who does not report what they find. That is exactly the point European supervisors warned about in their joint statement on AI and ICT risk at the end of July.
And the fixing falls to the projects themselves. These are often volunteers or small teams with no budget for a security round. Filing a finding now costs a fraction of what resolving it costs, and that gap is new.
What this means for you
You cannot act on a list you cannot see, but you can go over your own setup. Install updates to wallet software, node tooling and payment integrations as soon as they appear, because the fixes from this round will arrive over the coming weeks as ordinary updates. Read the release notes while you are at it: if they mention a security issue, that is the update that cannot wait.
If you use a hardware wallet, check whether the manufacturer has a security page and whether anything has been posted there recently. The Coldcard incident, in which on-chain analysis by TRM Labs found roughly 1,816 bitcoin (over 116 million dollars, roughly €101.5 million) gone from more than 5,200 addresses, came from firmware dating to 2021 that simply stayed in use for years. Old firmware is not stable firmware.
And the broader lesson: the fact that 85 critical findings exist is better news than nobody having looked. The problems were already there. What is new is that they are now being found and reported before someone else finds them.
Sources: Bitcoin Red Team via Bitcoin Magazine (6 August 2026), Crypto Briefing (6 August 2026), OpenSats, TRM Labs (Coldcard analysis, 5 August 2026). Last checked: 7 August 2026.