Subscribe
Back to News / Security

Bitcoin Red Team Report No. 3: Nearly 8,000 Security Findings Across 501 Bitcoin Projects and Still Counting

ME
BY MEGASLEY
Verified Contributor
| 3M AGO | 1 |
SECURITY DEVELOPMENT EXCLUSIVE

The Bitcoin Red Team is not slowing down. According to Red Team Report No. 3, compiled on August 8, 2026 at 21:16 UTC, the ongoing Bitcoin Security Review Campaign has now filed 7,958 security findings across 501 projects in the first 108 hours of operation. Furthermore, 168 of those findings are classified as critical and 1,120 as high severity, a combined 1,288 high-or-critical issues representing 16.2% of all findings logged to date.

The campaign is averaging 73.7 findings per hour and 11.9 high-or-critical findings per hour. Additionally, 174 projects (34.7%) have already had findings disclosed upstream to their maintainers. Notably, 24.7% of findings were dynamically reproduced, meaning the team confirmed them locally before disclosure, while 74% arrived through automated scan intake.

This is not a drill. Bitcoin’s open-source software ecosystem has a serious security problem, and a small volunteer group is the first to systematically prove it.

How the Bitcoin Red Team started

The campaign did not begin with a board meeting or a grant application. It began with the Coldcard hack.

In late July 2026, a firmware flaw in Coldcard hardware wallets — introduced in March 2021 — allowed attackers to rebuild private keys from predictable device details rather than true randomness. The exploit drained funds from hundreds of single-signature wallets. Losses climbed past $116 million across more than 1,800 BTC pulled from over 5,200 addresses. Decrypt

The scale of the losses caught the attention of two people. The first was Calle (@callebtc), the pseudonymous Bitcoin developer who created the Cashu ecash protocol and, notably, the same developer behind Tando’s onion routing observations we covered earlier this year. The second was Rob Hamilton, CEO of AnchorWatch, a Bitcoin self-custody insurance firm.

Together they organised the Red Team campaign in late July and early August 2026, assembling volunteers and securing funding from OpenSats, the open-source Bitcoin grant organisation. Total expenditures for the initiative came in at over $40,000. Coinspeaker

In a post on X, Calle said the group was “averaging on the order of 1 critical exploit per hour per person” and described the security situation as “extremely bad.”

The first sprint: 4,962 findings in 27.5 hours

The campaign’s opening sprint ran August 4 to 5, 2026. The numbers from that window were already alarming.

The Bitcoin Red Team filed 4,962 total security findings across 390 projects in 27.5 hours. Of those, 85 were classified as critical and 635 as high-severity. Crypto Briefing

The team leaned heavily on open-weight AI models to accelerate the scanning process. The toolkit included models like Kimi K3, GPT Sol, Fable, Opus, and GLM5.2, each deployed through a custom-built security harness designed specifically for this kind of rapid vulnerability discovery. Coinspeaker

Made up at one point of 171,599 lines of code, the harness was designed to identify and test critical Bitcoin software libraries and high-load-bearing code, identify and document vulnerabilities, reproduce them, and package the proven data into useful reports. The team has since committed to open-sourcing the harness, meaning the methodology could become a reusable baseline for future Bitcoin security reviews.

One caveat is worth noting. A single hour absorbed 4,101 findings during the first sprint. That spike was a backfill, not live scanning. Rob Hamilton had run his own review before the campaign formally began, spending over $10,000 scanning more than 100 libraries. Therefore, the per-hour rate for the first sprint reflects a methodology note, not pure real-time discovery throughout.

Report No. 3: the campaign at 108 hours

Image from @callebtc on X

The image you are reading about is Red Team Report No. 3, compiled at 108 hours and 36 minutes of elapsed campaign time. The numbers have grown substantially from the first sprint.

Specifically, from the report:

  • 7,958 total findings filed (5,620 found, 2,338 reported)
  • 501 projects with findings out of 502 reviewed
  • 168 critical and 1,120 high severity issues (1,288 combined)
  • 16.2% of all findings are high or critical, averaging 2.57 per project
  • 174 projects (34.7%) have had findings disclosed upstream
  • 73.7 findings per hour and 11.9 high-or-critical findings per hour
  • 0.56 high-or-critical findings per person-hour
  • 28 contributors total (25 human, 3 automated)
  • 24.7% of findings dynamically reproduced with proof-of-concept evidence
  • 74% of findings arrived via automated scan intake

The campaign has more than doubled its project coverage and nearly doubled its total findings since the first 27.5-hour sprint. Furthermore, the ratio of critical and high findings has grown — from the initial 14.5% to 16.2% of the corpus — suggesting that as the campaign digs deeper, it is finding proportionally more serious issues, not fewer.

What kinds of projects are affected

The category breakdown carries a surprise. Hardware wallets and firmware, the group Coldcard belongs to, ranked second lowest for serious flaws at 9.6%. Other corners fared worse. Mining pools hit 21.7%, infrastructure and tooling 21.5%, and swaps and exchanges 20.9%. Privacy tools topped the table at 24%, though reviewers covered only three of them. Crypto libraries carried the volume instead. They produced 1,385 findings across 128 projects, more than a quarter of the corpus.

In other words, the Coldcard hack was the trigger but not the category with the most serious findings. The most vulnerable slice of the Bitcoin ecosystem, proportionally, is the privacy and coinjoin tooling layer, the very tools many users rely on for transaction privacy. Furthermore, the infrastructure and tooling layer, which underpins everything from node software to developer libraries, carries a 21.5% serious-finding rate.

Responsible disclosure: the standard being set

The Bitcoin Red Team is not publishing vulnerabilities publicly before maintainers have a chance to fix them. All issues were reported privately before public disclosure. The team reproduces critical cases locally before transmitting them, ensuring that maintainers receive reports they can act on immediately. KuCoin

The Bitcoin Red Team followed a strict responsible disclosure process, reproducing critical issues locally before informing project maintainers privately. Prior to the August sprint, the group had already conducted scans of roughly 150 repositories that resulted in over a dozen private disclosures. KuCoin

Notably, contributors each prompt their own agents, which the group says produces a wider spread of hits than a single method would. Therefore, the approach combines the speed of AI-assisted automated scanning with the judgment of human researchers who verify, reproduce, and package findings before disclosure.

What this means for Bitcoin self-custody

The Coldcard hack was the immediate trigger. However, the Bitcoin Red Team’s findings suggest the problem is much broader. Specifically, the assumption that “open source equals reviewed” does not hold for most of the Bitcoin software ecosystem.

The Bitcoin ecosystem has long prided itself on its open-source ethos. In practice, most projects don’t receive meaningful security review unless they’re high-profile enough to attract attention or well-funded enough to pay for it. KuCoin

That gap is exactly what the Red Team is closing — but closing it requires acknowledging it exists first. The 7,958 findings across 501 projects are not evidence that Bitcoin’s software is uniquely broken. Instead, they are evidence that systematic security review reveals vulnerabilities in complex software, and that Bitcoin’s ecosystem has not had enough of it.

For the self-custody Bitcoin user, the immediate practical lesson is threefold. First, using well-maintained, widely reviewed software matters more than ever. Second, multisignature wallets distribute risk across multiple keys and implementations, so a flaw in one does not drain everything. Third, the Red Team’s responsible disclosure process means many of these vulnerabilities are being fixed quietly before anyone can exploit them.

What comes next

The campaign is ongoing. The Report No. 3 live clock shows the team still working as of August 8. The volunteer security effort says it is building an open-source AI platform to automate software security reviews, which could permanently raise the baseline for how the Bitcoin ecosystem approaches security going forward.

Furthermore, OpenSats has confirmed its funding commitment. Therefore, the campaign has both the resources and the mandate to continue well beyond the initial sprint window.

The Bitcoin Red Team is doing something that should have happened years ago. For a protocol that holds hundreds of billions of dollars in user value, systematic security review should be infrastructure, not improvisation. This campaign, born from a crisis, may become the model for how that infrastructure gets built.

The work continues. And at 73.7 findings per hour, so does the discovery.

Important accuracy note: The numbers in this article draw from two distinct data points. The early sprint numbers (4,962 findings, 85 critical, 635 high, 390 projects, 27.5 hours, August 4 to 5) come from published reporting. The Report No. 3 numbers (7,958 findings, 168 critical, 1,120 high, 501 projects, 108 hours, August 8) come directly from the report image you shared. These are cumulative figures for the same ongoing campaign.

Sources

ENJOYED THIS ARTICLE?Support the authorSend a zap over Lightning or on-chain
BITCOIN RED TEAM