> ## Content Index
> Fetch the complete content index at: https://wire.fourthweb.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI Found 5,000 Bitcoin Bugs in 30 Hours
- URL: https://wire.fourthweb.ai/ai-found-5-000-bitcoin-bugs-in-30-hours/
- Published: 2026-08-10T14:34:07.000Z
- Updated: 2026-08-10T14:37:07.000Z
- Description: The Bitcoin Red Team used frontier AI models to scan 390+ projects in under two days. What they found should terrify every Bitcoin holder.
- Author: Travis Wright
- Tags: Real World Assets, Bitcoin, AI Agents, AI Governance, Funding Rounds

After $100 million in Bitcoin walked out the door through a Coldcard firmware bug, a pseudonymous group of developers decided the industry's gentlemen's agreement on security was over.

The Bitcoin Red Team -- led by Calle, the developer behind the Cashu ecash protocol, and Rob Hamilton, CEO of custody firm AnchorWatch -- launched an AI-assisted security blitz across Bitcoin's entire open-source stack. Sixteen to 24 humans, backed by automated agents running around the clock, tore through wallets, cryptographic libraries, privacy tools, mining software, and infrastructure code. OpenSats funded it with tens of thousands of dollars in compute. Within the first 27.5 to 30 hours: roughly 4,962 findings across 390 projects. About 85 critical. About 635 high-severity. By the time the dust began to settle, the numbers had climbed into the low thousands for high and critical issues combined, spanning hundreds more projects.

The methodology is deliberately hybrid. Frontier models -- Kimi K3, OpenAI's and Anthropic's latest, GLM variants, custom agent harnesses -- do the first pass at scale. Humans then reproduce issues locally, triage severity, and handle responsible disclosure. More than 20% of findings were dynamically reproduced, which means they are not noise. The tooling will be open-sourced. This is not a one-time audit; the team is making the case for permanent red team infrastructure in Bitcoin.

The Coldcard exploit that triggered all this involved a flawed random number generator in firmware -- exactly the kind of subtle, hard-to-spot bug that AI excels at finding. That cuts both ways. If a funded team of researchers can run this playbook, so can a state actor or a well-capitalized criminal operation. The same open-weight Chinese models the red team is using are available to anyone. The lag between "AI finds the bug" and "AI exploits the bug at scale" is shrinking fast, and Bitcoin's security infrastructure has been running on volunteer goodwill and ad hoc disclosure for years.

The friction is already showing. Maintainers are getting overwhelmed by disclosures. Dozens of projects have no SECURITY.md, no contact email, no clear channel for receiving critical vulnerability reports. Some of the most depended-upon code in the ecosystem has never had a serious security review. The red team is not just finding bugs -- it is stress-testing the entire social infrastructure around how Bitcoin fixes them. The next question is whether the response will be as fast as the discovery.