Written by: Xiao Bing

16 individuals, 27.5 hours, 4962 security issues, 85 critical vulnerabilities, 635 high-risk vulnerabilities.

This set of numbers comes from a volunteer organization called the Bitcoin Red Team. Over the past two days, they conducted a comprehensive security audit on 390 open-source Bitcoin projects using AI models, averaging 166 findings per hour, with each person identifying one critical vulnerability every hour.

Calle, the founder of the Cashu protocol, published the first battle report on X, starting with four words that summarize the situation: "The situation is extremely bad."

But what is truly disturbing is not the numbers themselves.

$40,000 and a fire drill

This audit was not initiated out of thin air.

A week ago, the Bitcoin ecosystem experienced the largest security incident in the history of hardware wallets. The Coldcard wallet had a flaw in the random number generator from a firmware update in 2021, allowing private keys to be derived offline. Attackers siphoned off over 5200 addresses in four waves starting July 30, with tracking data from Galaxy Research showing a loss of approximately 1816 BTC, worth over $116 million at the time.

This bug lay quietly in the public code for five years, accessible for anyone to audit, but almost no one examined it systematically.

The Coldcard incident was the trigger. Calle and AnchorWatch CEO Rob Hamilton quickly formed the Red Team, obtaining funding from OpenSats, and burned over $40,000 on AI computing power. The models they used included Kimi K3 from Moonlight Dark Side, OpenAI's GPT Sol, Anthropic's Fable and Opus, and Zhipu's GLM5.2.

In the early stage of the project, access to OpenAI and Anthropic's models was limited, so the team mainly relied on Chinese open-source models. This detail is quite interesting: the safety of the world's largest cryptocurrency asset infrastructure is guarded by a group of volunteers armed with Chinese open-source AI working tirelessly.

After 27.5 hours, the data puzzle looks like this: 14.5% of the 4962 issues are classified as high-risk or critical, averaging 1.85 critical issues hit per project. Serious findings related to privacy tools and CoinJoin account for the highest proportion, reaching 24%; followed by exchange and swap protocols at 21%; cryptographic libraries and SDKs produced the most original findings (1101), but only 10% were classified as critical. 91% of the findings were submitted through automated scanning, and 21% have already been reproduced in local environments with proof-of-concept code.

Among the 17 contributors, 14 are human and 3 are automated systems.

The bottleneck has flipped

Rob Hamilton wrote on X something more important than all the numbers: "The hardest part is not finding bugs, but getting them into the hands of the right people."

In the world of traditional security research, "finding" is the most expensive part. A top security researcher might spend weeks reverse-engineering a piece of code to find an exploitable vulnerability. AI has driven that cost close to zero. 16 people collaborating with AI models produced in one day what a security audit firm would take months to accomplish.

The problem arises after the discovery. As of the report's release, only 19 out of the 390 audited projects (less than 5%) had completed upstream disclosures. Calle apologized to the maintainers in a tweet, acknowledging that the report surge increased their pressure and that the team is still learning how to filter out noise. Eight findings have been retracted as false positives.

This represents a structural change: AI has turned "finding bugs" into an almost free activity, while the bottleneck in the entire security pipeline has suddenly shifted downstream to verification, classification, routing to the correct maintainers, fixing, testing, and deploying patches. These steps still rely heavily on human effort, remain slow, and continue to be chaotic.

And this is precisely where attackers have a structural advantage.

An asymmetric arms race

Defenders need to complete a full chain: find vulnerabilities → verify → responsible disclosure → wait for maintainers to confirm → fix → push patches → user updates. Each step has friction and delays.

Attackers only need to: find vulnerabilities → exploit.

AI has made the starting point of the chain inexpensive for both sides. But the asymmetry in the subsequent steps means that this arms race naturally favors the attackers. The Coldcard case is clear proof: a bug from 2021 remained publicly stored in the codebase for five years, with defenders not performing systematic scans, while attackers used AI to identify predictable key spaces, sweeping away 1083 BTC in just 41 minutes.

A larger signal has already emerged. In April this year, Anthropic showcased Claude Mythos Preview, an AI model that was rejected for public release due to high security risks. According to Anthropic, Mythos could identify individual vulnerabilities at a computing cost of under $50, and the team discovered a 27-year-old flaw in the OpenBSD operating system. OpenBSD is recognized as one of the most secure operating systems globally and is widely used to run firewalls and critical infrastructure. Consequently, Anthropic initiated the Project Glasswing program, collaborating with around 40 organizations, including AWS, Apple, Microsoft, and Google, to patch vulnerabilities before attackers could exploit them.

In May, Google's Threat Intelligence team announced another milestone: they intercepted a criminal group using AI models to discover zero-day vulnerabilities and wrote exploit code for them. That vulnerability was a two-factor authentication bypass embedded in a widely used open-source management tool. Google identified the attack source through AI characteristics in the code (fictional CVSS scores, textbook-style Python comments) and completed the patch with the vendor before the criminal group could exploit it on a large scale.

John Hultquist, Google’s chief threat intelligence analyst, stated unequivocally: "To think that an AI vulnerability arms race is imminent is a misjudgment. The reality is that this race has already begun."

Open-source does not mean audited

Ledger CTO Charles Guillemet was quoted saying regarding the Coldcard incident: "Open source and audited are two different things."

This statement punctured a long-standing cognitive bubble in the crypto industry. The Bitcoin community holds an almost religious belief in open source, thinking that publicly available code means anyone can inspect it, thus it is inherently secure. Coldcard's code indeed remained open for five years. The Red Team's audit covered 390 projects. Together, these two facts paint a clear picture: auditable does not mean audited.

The experience of the Red Team also exposes the limitations of AI security audits. Calle mentioned that most of the team's work still involved "manually guiding AI," prompting the model with preferred methods to achieve a wider coverage than a unified approach. This indicates that current AI security audits are closer to "human experts operating AI tools" rather than "AI patrolling autonomously." While models can quickly scan code patterns, determining whether a finding is truly exploitable, the extent of its impact, and whom to notify still require human experience and judgment.

Hamilton mentioned the team plans to open-source the audit framework, allowing Bitcoin companies to run the same scans on their closed-source code. This is a step in the right direction but also means that the same tools will inevitably fall into the hands of attackers.

What this audit truly reveals is a new equation that is forming:

AI has made the cost of discovering vulnerabilities approach zero. But the cost of fixing vulnerabilities (organization coordination, human investment, user migration) remains expensive and slow.

With $40,000 worth of AI computing power, 27.5 hours can turn an open-source ecosystem managing hundreds of billions of dollars upside down. A bug that went unnoticed in Coldcard for five years was found by attackers who, within 41 minutes, stole $116 million.

The security narrative of Bitcoin is being rewritten.

The past logic was: "The code is open source, so it is secure." The new logic is harsher: "The code is open source, so attackers are also using AI to scan it."

The only advantage defenders have is being proactive, finding and fixing vulnerabilities before the attackers. The Red Team is vying for this proactive stance, but their battle report also indicates that even with the advantage, the subsequent patch distribution chain remains the weakest link in the ecosystem.

The predicament facing Bitcoin may just be a rehearsal for a larger transformation. The entire open-source software world is about to face the same questioning: when discovering bugs no longer requires experts, but fixing bugs still does, what will bridge this gap?