Bitcoin Developers Uncover Nearly 5,000 Bugs In Coordinated Security Sweep

Sixteen Bitcoin developers ran AI models against bitcoin wallets, cryptographic libraries and infrastructure, filing 4,962 findings across 390 projects within 24 hours. The coordinated effort uncovered 85 critical and 635 high-severity issues, according to pseudonymous Cashu developer Calle. “Situation is extremely bad,” Calle said, noting the group is averaging roughly one critical bug per hour per person at about $10,000 a day in compute costs.

Verification Process Moves Quickly

Calle said most critical reports are verified by project owners and reproduced with working proof-of-concept tests before submission, though the sheer volume has created confusion. “There’s a lot of chaos right now in the ecosystem,” he wrote, apologizing to maintainers overwhelmed by reports.

Routing Findings Remains The Real Bottleneck

Rob Hamilton, who built the group’s automated testing setup, said the challenge isn’t finding bugs but getting them to the right maintainers. “The hardest part is coordinating to get things to the right people,” he said, calling the current effort only a first version.

Comes Amid Fresh Wallet Security Concerns

The audit follows the Coldcard wallet sweeps that began July 30, which drained as much as $114 million from wallets affected by a firmware bug dormant since 2021. Researchers have also flagged past cases of AI models uncovering long-hidden software flaws in widely used encryption and banking systems.