Bitcoin Red Team’s AI Audit Finds 85 Critical Bugs Across Bitcoin Repos
The Coldcard hardware wallet story just got a second act, and this one is less about the original bug and more about how much else might be lurking undiscovered across Bitcoin’s open-source codebase.
A volunteer group calling itself the Bitcoin Red Team ran a 24-hour AI-assisted security audit across 390 open-source Bitcoin repositories and found 85 critical-severity bugs and 635 high-severity bugs, nearly 5,000 findings in total. The audit was launched directly in response to the Coldcard incident, a five-year-old firmware flaw that routed wallet seed generation to a predictable software random number generator instead of the device’s dedicated hardware entropy source, a bug that has now driven losses past $100 million across more than 4,500 affected addresses since thefts began in late July.
Kraken’s Chief Security Officer Nick Percoco has since gone public calling for independent, standardized hardware wallet testing, arguing the Coldcard incident exposed a genuine blind spot: a flaw sitting undetected in shipped devices for half a decade despite the product being widely trusted and reviewed by its own userbase.
The scale of the AI audit’s findings is the more unsettling part of this story. Nearly 5,000 flagged issues across less than 400 repositories in a single day suggests either a genuinely large volume of latent bugs across Bitcoin’s open-source ecosystem, or meaningful noise in how the audit tooling classifies severity, and likely some combination of both, though the raw count alone is enough to justify closer scrutiny either way.
Calls for independent hardware wallet certification standards have circulated before without much traction, but a live incident with a nine-figure loss total and a security chief at a major exchange publicly backing the idea may carry more weight than prior proposals.
Want to understand how hardware wallets are supposed to generate secure private keys in the first place? Learn more in the Bitcoin Academy.