Image Credit: Shutterstock
Key Takeaways
- Sixteen developers filed 4,962 security findings, including 85 critical and 635 high-severity issues, across 390 Bitcoin projects using AI-assisted review
- Each critical report is reproduced with a working proof of concept before submission, and Calle said coordinating with maintainers, not finding bugs, is now the hardest part
- The defensive audit comes as the ecosystem absorbs a separate Coldcard firmware exploit that has drained up to $114 million using flawed key generation dormant since 2021
Sixteen Bitcoin developers filed 4,962 security findings across 390 Bitcoin projects in a little over 24 hours, using AI models to scan wallets, cryptographic libraries and infrastructure code. The findings include 85 critical and 635 high-severity issues, according to the pseudonymous developer known as Calle, who leads the effort.
Calle, the developer behind the Cashu ecash protocol, said in a series of X posts that the volunteer group is now averaging roughly one critical bug per hour per participant, running the audit at a cost of about $10,000 a day in compute.
Audit Combines AI Tools With Manual Review
The findings come from a coordinated push in which developers point AI models at Bitcoin codebases while manually reviewing the output. Calle said much of the work still involves guiding the AI directly, though the group’s automated review systems are improving in parallel.
The team has not settled on a single review method. Calle said letting each participant use their preferred approach has so far produced the best results.
Verification Keeps Pace, but Volume Strains the System
Most critical reports have been verified quickly by the projects that received them, Calle said, with the group reproducing each issue using a working proof of concept in a local test environment before submission. That step is meant to filter out false positives before maintainers see a report.
Even so, Calle said the pace is straining the ecosystem’s capacity to respond, writing,
“Situation is extremely bad. […] There’s a lot of chaos right now in the ecosystem.”
Calle apologized to maintainers dealing with the backlog and said the group is still working out how to filter lower-quality submissions from the flow of legitimate findings.
Coordination, Not Discovery, Is the Bottleneck
Rob Hamilton, who built the automated system the group uses, said in a separate X post that finding bugs is no longer the hard part of the process, adding,
“The hardest part is coordinating to get things to the right people.”
Hamilton described the current tooling as an early version of what the group is building. The group publishes findings quickly in part because maintainers can now verify them at low cost using the same AI tools, Calle said, and because other researchers outside the group are likely to reach the same findings independently.
Audit Follows a Separate Exploit That Drained Bitcoin Wallets
The defensive push comes as the ecosystem is still absorbing the fallout from an attack that moved first. The Coldcard wallet exploit, which began July 30, has taken as much as $114 million from wallets whose seed phrases were generated by flawed firmware.
That bug had been dormant since 2021 and required no physical access to the affected devices once the vulnerable key space was identified.
The Coldcard exploit and the Bitcoin developers’ audit both rely on AI-assisted methods, though for opposing purposes. Anthropic said in April that one of its models, restricted to a small group of vetted users, identified a vulnerability that had gone undetected in widely used encryption software for 27 years, at a compute cost of under $50.
The flaw affected software securing banking connections, exchange logins and much of the internet’s server infrastructure.
Google’s threat intelligence team separately said in May that it had intercepted a criminal group preparing to exploit a vulnerability an AI model had identified on the group’s behalf. The same tools are now being used defensively by Bitcoin’s developer community.
