The figures paint a picture of how vulnerable the current running infrastructure is. A volunteer group of 16 people calling themselves the Bitcoin Red Team reported the discovery of 4,962 potential security vulnerabilities in 390 open-source projects related to Bitcoin.
They recorded this achievement in just the first 29.8 hours since the sweep operation began. Out of the thousands of code flaws detected, as many as 720 findings were immediately classified as high-risk or critical-level issues.
This is not just a list of warnings from software. A total of 21.4% of all potential findings are verified and reproducible - meaning this team of experts successfully proved that real hackers could exploit the same vulnerabilities.
“We are averaging 1 critical exploit per hour per person,” said Calle, one of the Bitcoin developers who participated directly in the team alongside Rob Hamilton, CEO of AnchorWatch.
Aftermath of the Hundred-Million-Dollar Hack
This rapid sweep operation did not emerge without a trigger. The Bitcoin Red Team launched this audit campaign just days after a hack hit Coldcard, an incident that stole more than $100 million of Bitcoin.
Combining AI and Manual Testing
Combing through 390 projects in less than 30 hours would be impossible to do manually alone. To get around time constraints, this volunteer team applied a multi-layered method.
They combined the speed of artificial intelligence tools with direct human review. AI was tasked with scanning code repositories of open-source projects to detect anomalies. Once the machine flagged suspicious areas, the experts took over to dissect and test those findings, separating real threats from mere false alerts.
Why the Ecosystem Is Still Chaotic
Following the $100 million theft incident at Coldcard, conditions on the ground are still far from stable. Calle described the current state of the Bitcoin ecosystem as “chaotic.”
This chaos occurred due to a flood of post-Coldcard security reports. The Bitcoin Red Team’s discovery of nearly five thousand vulnerabilities in a short period adds to the checklist of tasks that project maintainers must immediately resolve before those critical vulnerabilities are found by outsiders.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
