Key Takeaways A comprehensive security assessment identified 4,962 security vulnerabilities across 390 Bitcoin-related projects within approximately 30 hours Among these findings, 720 were cl
A team of volunteer security experts has submitted approximately 5,000 vulnerability disclosures throughout the Bitcoin infrastructure following a significant hardware wallet security incident.
Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7
We're running a large-scale ecosystem security audit across bitcoin code bases.
27.5 hours in, we've filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues.
We're at… pic.twitter.com/iRCylprbY1
— calle (@callebtc) August 5, 2026
The Bitcoin Red Team conducted an examination of 391 open-source repositories, identifying 4,962 security weaknesses. Just a single project emerged without any detected issues.
Among the total discoveries, 720 received high or critical severity ratings, representing approximately 14.5% of all submitted findings. To date, merely 147 of these urgent vulnerabilities have been transmitted to the maintainers tasked with remediation.
The examination commenced following Coinkite’s July 30 announcement that seed generation processes on compromised Coldcard devices had reverted to a predictable software mechanism. With only 32 bits originating from the secure element, an adversary could enumerate all potential keys through approximately 4.3 billion computational attempts.
Galaxy Research estimated confirmed losses at 1,596 Bitcoin from approximately 7,300 wallet addresses as of August 4. A potential fourth wave of attacks could elevate total damages to nearly $130 million.
The Coldcard security incident drove active Bitcoin addresses to their highest level in 20 months according to on-chain metrics.
Contrary to expectations given the Coldcard catalyst, hardware wallets registered the second-lowest percentage of severe vulnerabilities at 9.6%. Mining pools topped the list at 21.7%, with infrastructure and tooling at 21.5%, and swap platforms and exchanges at 20.9%.
Cryptographic libraries generated the highest volume of individual findings, accounting for 1,385 issues spanning 128 projects—exceeding one-quarter of all discoveries.
Approximately 21.4% of identified vulnerabilities included functional proof-of-concept demonstrations. Around 91% were detected using automated scanning tools.
A single hour within the 30-hour initiative captured 4,101 findings independently. This concentration represented a data import from AnchorWatch CEO Rob Hamilton’s prior individual assessment, during which he invested more than $10,000 examining over 100 libraries.
Calle, the anonymous physicist who developed the Cashu ecash protocol, noted that project maintainers have been rapidly validating the most critical submissions.
Hamilton reported that OpenAI imposed access limitations on his account the morning following his integration of its Trust and Cyber features into his Red Team operations. He indicated this restriction prevented him from advancing his security investigation.
He explained that he was forced to transition to Chinese open-source artificial intelligence platforms to continue his work, describing the situation as deeply disappointing from an American perspective.
Hamilton contended that malicious actors encounter no comparable limitations, while legitimate researchers working to minimize security risks face obstacles.
OpenSats addressed the situation by establishing a Code RED grant initiative, which provides compensation to researchers for validated vulnerability disclosures and covers their artificial intelligence usage expenses.
Bitcoin was trading around $64,396 at press time, reflecting a 0.5% increase over the previous 24 hours. The security assessment has not influenced market pricing.
The post Bitcoin Security Sweep Uncovers Nearly 5,000 Flaws Following Coldcard Breach appeared first on Blockonomi.
