Back
Bitcoin Red Team audit sprint finds 4,962 security issues across roughly 390 codebases

Bitcoin Red Team audit sprint finds 4,962 security issues across roughly 390 codebases

The volunteer, AI-assisted review later hit OpenAI and Anthropic access restrictions, with Rob Hamilton saying OpenAI cut off Trust & Cyber analysis within a day and pushed the effort back toward Chinese open-source models.

BTC

Fact Check
All specific claims are corroborated by multiple independent sources. Cryptobriefing confirms 16 members, 390 projects, 4,962 findings (85 critical + 635 high = 720), and the Coldcard trigger. Spendnode and LCX (both citing Cointelegraph) independently confirm the 720 high/critical figure, the 21.4% reproducibility rate, the 16-member team, and the Coldcard exploit as the catalyst. The 'nearly 5,000' phrasing accurately rounds 4,962, and '720 high-risk or critical findings' matches exactly. The only minor variance is the sprint duration (27.5 vs ~30 hours), which does not affect the claim's substance.
    Reference: 123
Summary

A roughly 30-hour Bitcoin Red Team security campaign uncovered 4,962 software issues across about 390 Bitcoin-related projects, including 85 critical and more than 635 high-severity findings, as volunteers used AI tools to accelerate reviews after the Coldcard hardware wallet flaw. Rob Hamilton, AnchorWatch CEO, later said OpenAI restricted access to its Trust & Cyber capabilities the morning after he began integrating them into the work, and that earlier restrictions from OpenAI and Anthropic pushed the team toward Moonshot AI's Kimi K3 and other Chinese open-source models despite completed compliance checks. Hamilton said the findings were responsibly disclosed to maintainers, the project spent about $20,000 to $40,000 on compute, and roughly 21% of flagged issues were independently reproduced as real vulnerabilities.

Terms & Concepts
  • responsible disclosure: The practice of privately reporting security flaws to developers or maintainers before publicizing them so fixes can be prepared.
  • KYC: Short for know your customer, an identity verification process platforms use to confirm who is accessing their services.
  • open-source models: AI models whose weights or code are made available for broader use, modification or self-hosting.