Bitcoin Red Team Finds Nearly 5,000 Issues in 30-Hour Audit

Bitcoin Red Team, a volunteer security group of 16 people, reported it found 4,962 potential issues across 390 Bitcoin-related projects during a 29.8-hour audit that paired automated scanning with human review.

The volunteer effort includes Rob Hamilton, CEO of AnchorWatch, and Bitcoin developer Calle. The team used machine-assisted tools to scan open-source repositories and followed up with manual inspection to prioritize and test flagged items.

Among the findings, up to 720 were classified as high- or critical-level. Reviewers have reproduced 21.4% of the flagged issues so far; the remaining reports are undergoing further verification.

Calle wrote on X: “We’re averaging on the order of 1 critical exploit per hour per person.” The post described the speed at which the team surfaced serious issues by combining automated scans with manual analysis.

The campaign began days after a recent hardware wallet breach that resulted in more than $100 million in stolen Bitcoin. Organizers framed the effort as a rapid, volunteer-led scan of widely used open-source code in the Bitcoin ecosystem rather than a formal paid audit.

Bitcoin Red Team did not publish a complete list of findings in its initial update, providing only summary metrics and participant names. The group indicated that manual verification and disclosure to project maintainers are the next steps but did not outline a detailed follow-up plan.

Security researchers have increasingly turned to automated tools and large language models to speed code review. Manual reproduction of issues remains necessary to confirm whether a flagged vulnerability is exploitable.