Bitcoin AI Safety Audit Information 4,962 Findings Throughout 390 Tasks – Decrypt

Briefly
Cashu creator calle mentioned the marketing campaign logged 85 essential and 635 high-severity points in its first 30 hours.
Contributors every immediate their very own brokers, which the group says produces a wider unfold of hits than a single technique would.
Privateness and coinjoin tasks carried the very best share of great findings, at 24%.
A volunteer group calling itself the Bitcoin Crimson Group has filed 4,962 safety findings throughout 390 Bitcoin tasks in roughly 30 hours, operating what it describes as a “large-scale ecosystem audit” with AI brokers doing a lot of the scanning.Pseudonymous developer calle, who created the Bitcoin ecash protocol Cashu, printed the marketing campaign's first state of affairs report on Wednesday. It places 85 findings at essential severity and 635 at excessive, collectively 14.5% of the corpus and a median of 1.85 critical points per challenge, filed at 166 findings an hour. He mentioned the group has grown to 16 individuals working across the clock; the report logs 17 contributors, 14 of them human and three automated.
Bitcoin Crimson Group replace: we have grown to 16 globally distributed individuals working 24/7
We're operating a large-scale ecosystem safety audit throughout bitcoin code bases.
27.5 hours in, we have filed 4,962 findings throughout 390 tasks. 85 essential and 635 excessive severity points.
We're at… pic.twitter.com/iRCylprbY1
— calle (@callebtc) August 5, 2026Much of the work continues to be handbook, “hand holding the AI,” calle wrote, although automated harnesses are enhancing, and 91% of findings arrived by automated scan consumption. Letting everybody use their very own most well-liked evaluate technique “has confirmed to be the best technique,” he mentioned, as a result of contributors immediate their brokers otherwise and switch up completely different bugs. Round 21% of findings have been dynamically reproduced with proof-of-concept code.The severity unfold varies sharply by class. Privateness and coinjoin instruments returned the very best proportion of high-or-critical findings at 24%, adopted by swaps and exchanges at 21% and funds and service provider instruments at 17%. Cryptographic libraries and SDKs produced the most important uncooked quantity at 1,101 findings, however solely 10% cleared the excessive bar.Maintainers are getting floodedOnly 19 tasks, below 5% of these reviewed, have had findings disclosed upstream to date, and calle acknowledged the marketing campaign is including to a troublesome second for maintainers.”We're sincerely sorry if our experiences added stress to your already hectic day,” he wrote, whereas arguing the findings ought to exit quick as a result of challenge house owners are greatest positioned to validate them, validation is now almost free with AI, and anybody else operating the identical instruments will attain the identical bugs. Eight findings have been retired as false positives.The Coldcard backdropThe marketing campaign lands as Bitcoin's safety assumptions come below scrutiny. Coinkite's Coldcard pockets misplaced customers some $130 million after a March 2021 firmware construct drew pockets seeds from a software program fallback quite than the system's {hardware} random quantity generator, leaving personal keys guessable. In a autopsy, the agency famous it was seemingly that “somebody used AI to evaluate earlier variations of our firmware.”Ledger chief know-how officer Charles Guillemet advised Decrypt on Tuesday that the incident confirmed AI was now getting used to determine vulnerabilities in crypto code “at machine velocity.” He added that “open supply and reviewed aren't the identical factor,” noting the Coldcard flaw sat in public code for greater than 5 years till an adversary reportedly used AI to search out it. Defence, he argued, now has to maneuver on the similar velocity as attackers—as teams just like the Bitcoin Crimson Group are demonstrating.Each day Debrief NewsletterStart every single day with the highest information tales proper now, plus unique options, a podcast, movies and extra.