Bitcoin Red Team Discovers 4,962 Security Issues Amid Coldcard Exploit

Overview of the Bitcoin Red Team’s Findings

A volunteer security group known as the Bitcoin Red Team has uncovered 4,962 potential security issues across 390 Bitcoin-related projects during a series of AI-assisted code reviews that spanned just under 30 hours. Among these findings, 720 have been classified as high or critical severity, reflecting serious vulnerabilities within the Bitcoin ecosystem.

Context of the Review Campaign

This extensive review campaign was launched shortly after Coldcard wallet attacks that revealed significant firmware flaws. Following these attacks, Bitcoin developers and researchers have intensified their scrutiny of various Bitcoin software components in response to the threats identified.

Details from the Review Process

According to Bitcoin developer Calle, the campaign has successfully executed both automated and manual reviews across diverse Bitcoin-related repositories. The team reported that approximately 21.4% of issues identified have been reproduced, signaling that many of the AI-detected vulnerabilities have been successfully verified by independent testing.

The initiative incorporates help from notable figures in the Bitcoin community, such as Rob Hamilton, CEO of AnchorWatch, and relies on AI tools alongside thorough manual examination to discover software vulnerabilities. Calle noted that the pressing security situation is reflected in the group’s findings, stating they are “averaging one critical exploit per hour per person” and have already notified several projects about critical vulnerabilities.

Security Issues Linked to Coldcard Exploit

The initiative’s urgency stems from a recent significant wallet security incident where attackers capitalized on a Coldcard hardware wallet flaw and allegedly stole approximately 1,596 BTC from about 7,300 addresses. Additional investigations indicated further possible losses, prompting the need for heightened vigilance in reviewing Bitcoin software.

Ongoing Efforts and Community Involvement

The review initiative aims not only at rectifying current vulnerabilities but also at maximizing community involvement. The team has incurred roughly $10,000 daily in computing expenses, funded by OpenSats, as they push to review various aspects of the Bitcoin infrastructure.

The Bitcoin Red Team continues to be active, with ongoing submissions of identified vulnerabilities to the relevant software projects. The collaborative nature of this volunteer effort blends AI-supported analyses with detailed human assessments to ensure the evolving Bitcoin ecosystem remains secure.