- Published on
Bitcoin developers flag 85 critical bugs in an 'extremely bad' situation
- Authors
- Name
- DeepHorus
A volunteer team of Bitcoin developers has uncovered a staggering 4,962 security vulnerabilities across 390 projects in a single coordinated audit, including 85 critical and 635 high-severity bugs. The findings, announced this week by Calle, the pseudonymous developer behind the Cashu ecash protocol, paint what he called an “extremely bad” picture for the cryptocurrency ecosystem. The audit was conducted by sixteen developers using AI models to scan Bitcoin wallets, cryptographic libraries, and core infrastructure, with computing costs running about $10,000 per day.
The effort emerged from a growing recognition that AI tools can dramatically accelerate security research, both for defenders and attackers. Calle noted that while much of the work still involves manual hand-holding of the AI, automated harnesses are improving rapidly. The group deliberately publishes findings fast because maintainers can now verify almost anything for free using the same AI tools, and because “others who aren't on the red team will arrive at the same findings as we did.”
Most critical reports have already been verified by project owners, with working proof-of-concept exploits reproduced in local test environments before disclosure. However, the sheer volume is overwhelming project maintainers, many of whom are buried in new issue reports. Calle apologized for the chaos, admitting the team is still learning to separate genuine findings from “the slop.” Rob Hamilton, who built the automated setup, said the main bottleneck is no longer discovering bugs but routing them to the right people — a challenge he described as “version one” of a powerful new approach.
The audit lands in an ecosystem already reeling from a separate AI-assisted security failure. The Coldcard wallet incident, which began July 30 and drained as much as $114 million from wallets with faulty firmware-generated seeds, traced back to a bug dormant since 2021. Attackers now have the same tools as defenders: Anthropic revealed in April that a model kept from public release found a 27-year-old flaw in widely used encryption software for under $50, and Google’s threat intelligence team caught a criminal group using an AI-discovered vulnerability in May.
The implications extend far beyond Bitcoin. As AI-driven audits become cheaper and faster, the security landscape is shifting from a slow, manual process to an automated arms race. For maintainers, the immediate challenge is triage and coordination, while for users, the risk of undiscovered critical flaws is shrinking — but the window for patching is narrowing. The group plans to refine its automated harnesses and improve reporting channels, but Calle warned that the ecosystem must adapt quickly. This audit is likely just the beginning of a new era where AI combs through code at machine speed, forcing every project to rethink its security posture or risk being left behind.
