Bitcoin Red Team finds nearly 5,000 potential security flaws

The Bitcoin developer community has completed one of its largest security reviews ever, uncovering 4,962 potential vulnerabilities across 390 open-source Bitcoin projects .

The initiative, known as the Bitcoin Red Team , was launched after the recent Coldcard wallet vulnerability exposed weaknesses in Bitcoin security. The goal is to find software bugs before attackers can exploit them.

Out of the 391 codebases reviewed, only one project was found to have no security issues.

The review identified vulnerabilities ranging from low-risk bugs to critical security flaws.

According to the team's report:

Overall, 720 vulnerabilities were classified as either High or Critical, representing roughly 14% of all findings.

The report also explains how the vulnerabilities were discovered.

Around 91% of all findings came from automated AI-powered security scanning, while roughly 21% included working proof-of-concept demonstrations showing how the issue could potentially be exploited.

The team says only eight reports were later dismissed as false positives, suggesting that most findings deserve further investigation.

So far, only 147 vulnerabilities have been reported directly to project maintainers, who are responsible for reviewing and fixing the issues.

Although the report highlights nearly 5,000 findings in 30 hours , the timeline deserves some explanation.

According to AnchorWatch CEO Rob Hamilton , more than 4,100 findings were uploaded during a single hour. These were not generated live but were part of an earlier security review completed before the public campaign officially launched.

Hamilton said he had already spent more than $10,000 auditing over 100 Bitcoin software libraries before joining the broader initiative.

Without that earlier batch of reports, the team discovered roughly 840 findings during the remaining hours of the campaign.

One surprising result from the audit is that hardware wallets were not the biggest source of security problems .

Instead, the largest number of findings came from Bitcoin software libraries used by many applications.

The researchers say this shows that security risks exist across the broader Bitcoin ecosystem, not just in hardware wallets.

The Bitcoin Red Team was formed shortly after Coinkite disclosed a serious vulnerability affecting some Coldcard hardware wallets .

The flaw allowed affected devices to generate wallet seeds using weak randomness under certain conditions.

Security researchers later estimated that attackers stole roughly 1,596 BTC from thousands of affected addresses. If additional suspected attacks are confirmed, total losses could approach $130 million .

The incident prompted developers to launch a much wider review of Bitcoin's open-source software to identify similar weaknesses before they can be exploited again.

The audit has also attracted support from OpenSats , a nonprofit organization that funds Bitcoin development.

OpenSats recently introduced its Code RED grant program, which rewards researchers who responsibly report software vulnerabilities.

The initiative also helps cover the cost of AI-powered security tools used during large-scale code reviews.

Developers hope these incentives will encourage more researchers to identify security issues before they become real attacks.

The discovery of nearly 5,000 vulnerabilities does not mean Bitcoin itself has been compromised.

Most of the findings are potential software issues that still need to be reviewed by individual project maintainers. Many may never become real-world exploits.

However, the audit highlights how important ongoing security reviews have become as Bitcoin's software ecosystem continues to grow.

The recent Coldcard incident showed that even trusted projects can contain hidden vulnerabilities. By identifying these issues early, developers hope to strengthen Bitcoin's open-source infrastructure and reduce the risk of future attacks.

Bitcoin moved above $65,000 as weaker U.S. jobs data reduced expectations of a September Fed rate hike. MSTR also topped $100, while Pi Network led altcoin gains.

BNB Chain has surpassed 300,000 RWA holders, strengthening its position in tokenized assets and potentially supporting a BNB price recovery toward $620.

The Coldcard Bitcoin hack has now caused more than $111 million in confirmed losses, with Galaxy Research warning that total theft could exceed $130 million.