A volunteer security group calling itself the Bitcoin Red Team has logged 4,962 potential issues across the Bitcoin ecosystem in its first 29.8 hours of work, according to a Cointelegraph report published August 6, 2026. Of those, 720 were classified as high- or critical-level, and 21.4% were reproducible on review.
The group is 16 people, including AnchorWatch CEO Rob Hamilton and Bitcoin developer Calle. Their method pairs AI-assisted code scanning with human verification, aimed at open-source repositories rather than any single client. The scope covered 390 projects, which stretches the review well past Bitcoin Core into wallets, libraries, and the smaller tools that hold the ecosystem together.
The number that stands out
"We're averaging on the order of 1 critical exploit per hour per person," Calle said. That figure is doing most of the work in the story, and it cuts two ways.
On one reading, it says the tooling has caught up: a small group with modern AI review can surface exploit-class bugs faster than manual auditing ever allowed. On the other, it says the codebase everyone depends on is carrying far more unreviewed risk than the "many eyes" reputation of open source would suggest. Both can be true. A high raw count from an AI pass is expected, which is why the 21.4% reproducible rate and the 720 high or critical tags matter more than the headline 4,962.
The Coldcard breach set the clock
The audit push did not appear out of nowhere. It follows the Coldcard hardware wallet exploit that pushed roughly $100 million in Bitcoin out of cold storage, an event that shook the part of the market that treats hardware devices as the safe default. Calle acknowledged the mood directly, noting that people are being "bombarded with security issues" and that the ecosystem is in a rough stretch.
That context reframes the sprint. This is not a scheduled quarterly review. It is a reaction to a live loss, and the speed reflects urgency more than routine. For anyone holding Bitcoin in self-custody, the takeaway is uncomfortable but useful: the security assumptions baked into hardware wallets and their supporting software are being stress-tested in public, in real time.
Raw findings are not confirmed vulnerabilities
A count of 4,962 issues is a starting point, not a verdict. AI review generates false positives, duplicates, and low-severity noise alongside genuine bugs. The reproducible share of 21.4% is the honest denominator here, and even a reproducible finding still needs triage, disclosure, and a patch before it counts as fixed. The 720 high or critical items are the queue that actually matters, and clearing that queue is slower and less glamorous than generating it.
There is also a coordination problem. Findings spread across 390 projects land on hundreds of separate maintainers, many of them unpaid and part-time. A critical bug in a widely used library is only closed when its maintainer sees it, understands it, and ships a fix that downstream projects then adopt. The gap between "flagged" and "resolved" is where risk lives.
The steady-hygiene play for holders
The practical response is not to panic-move funds, which is often how people get phished during exactly these windows. The Coldcard episode already showed that fear-driven transfers out of cold storage create their own attack surface. Steady hygiene is the better play: keep firmware and wallet software current, apply patches only from official sources, and treat urgent "move your coins now" messages as suspect by default.
For hardware wallet makers such as Ledger and their competitors, an audit campaign of this scale is a stress test of disclosure processes as much as code. The measure of the Red Team effort will not be the 4,962 number. It will be how many of the 720 high and critical findings turn into shipped fixes, and how fast.
Overview
The Bitcoin Red Team, a 16-person volunteer group, logged 4,962 potential issues across 390 Bitcoin ecosystem projects in 29.8 hours using AI-assisted plus human review. 720 were rated high or critical and 21.4% were reproducible. The effort follows the Coldcard hack that drained roughly $100 million from cold storage. The raw count signals both faster tooling and deep unreviewed risk, but the real test is how many high-severity findings get patched, not how many were flagged.
