An AI-assisted campaign called Bitcoin Red Team says it generated 6,700 security findings across 425 Bitcoin projects in its first 55 hours, with 1,029 rated high or critical. The update measures how much material entered a review pipeline, not how many findings are real, since the campaign has not published valid, rejected, or fixed counts.
Bitcoin Red Team, an AI-assisted security campaign focused on the Bitcoin ecosystem, said it generated 6,700 findings across 425 projects in its first 55 hours, labeling 1,029 of them high or critical. The Aug. 6 update measures how much material entered a security triage pipeline, but its effect on software security remains unreported.
The retrieved thread omitted audit-ready definitions and denominators for the severity counts, along with case-level outcomes, an aggregate false-positive rate, and a fix rate. Those missing fields prevent a calculation of how many alerts became confirmed vulnerabilities, how many maintainers rejected or downgraded, and how many led to patches. Still, the first 55 hours reveal a real capability: AI systems can fill an ecosystem-scale review pipeline quickly, even as expert prompting, reproduction, disclosure, and maintainer response stay necessary at every later stage.
Two snapshots track a growing workload
The campaign published two snapshots as its roster and workload expanded. At the 27.5-hour mark, it covered 390 projects and reported 4,962 findings, including 85 critical and 635 high, with 16 participants. By the 55-hour mark, the project count had risen by 35 and the finding count by 1,738, and high-or-critical findings reached 15.4% of the total, with 24 reported participants including three bots.
Its earlier post separated critical and high findings, while the later one combined them, and both sets of figures reflect campaign assessments rather than independently confirmed outcomes. Maintainer-confirmed exploitability and remediation still require separate evidence.
Humans and models split the review work
Rob Hamilton described Kimi K3 as handling the heavy analysis, with GPT Sol, Fable/Opus, and GLM 5.2 supporting documentation, while OpenAI's Cyber Harness covered selected components he considered load-bearing. A day later, he wrote that subject-matter experts could change an assessment with one or two sentences of context or a small block of code, pushing middling concerns into high or critical territory in the examples he described. He also identified operations, disclosure handoff, and triage as bottlenecks.
In Hamilton's account, models searched broadly while specialists shaped prompts, interpreted output, attempted reproduction, and decided which reports were ready for disclosure — a human-AI review system.
Outreach data still leaves outcomes unresolved
In the 55-hour update, Bitcoin Red Team reported that 19.5% of scanned projects had a SECURITY.md file and 13.1% had an email there, though the thread omitted the project corpus and measurement method behind those percentages. On Aug. 3, Hamilton said the effort had spent over $10,000 scanning over 100 repositories and had disclosed critical findings immediately once a proof of concept showed exploitability. On Aug. 4, he reported about $20,000 in spending, more than a dozen disclosures, and 150 repositories scanned.
Hamilton later pointed to the separate Coldcard incident as a catalyst for the wider campaign, though the campaign record credits no discovery of that flaw to this sprint. Developer Calle said most critical reports were quickly verified by project owners, but supplied no denominator, rejection count, or patch status.
A public critic, JW Weatherman, argued the campaign could not triage its output, though his post identified no campaign-linked issue, patch, or advisory. For now, 6,700 stands as a count of campaign-labeled findings and triage candidates — its lasting security value depends on the share that experts can validate, disclose, and convert into fixes.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
