Bitcoin Red Team finds 4,962 issues reviewing Bitcoin projects after Coldcard exploit

cryptonews14:47

A volunteer Bitcoin security initiative has identified 4,962 potential security issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted code reviews, with 720 classified ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2657500995?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-06 14:47","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2657500995","market":"sh","top_or_hot":-1,"title":"Bitcoin Red Team finds 4,962 issues reviewing Bitcoin projects after Coldcard exploit","media":"cryptonews","content":"<div>\n<p>A volunteer Bitcoin security initiative has identified 4,962 potential security issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted code reviews, with 720 classified ...</p>\n\n<a href=\"https://crypto.news/bitcoin-red-team-finds-4962-issues-reviewing-bitcoin-projects-after-coldcard-exploit/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Bitcoin Red Team finds 4,962 issues reviewing Bitcoin projects after Coldcard exploit</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBitcoin Red Team finds 4,962 issues reviewing Bitcoin projects after Coldcard exploit\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-06 14:47 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/bitcoin-red-team-finds-4962-issues-reviewing-bitcoin-projects-after-coldcard-exploit/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>A volunteer Bitcoin security initiative has identified 4,962 potential security issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted code reviews, with 720 classified ...</p>\n\n<a href=\"https://crypto.news/bitcoin-red-team-finds-4962-issues-reviewing-bitcoin-projects-after-coldcard-exploit/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTRN","symbol_name":"比特币期货ETF-Global X","start_time":0,"source_url":"https://crypto.news/bitcoin-red-team-finds-4962-issues-reviewing-bitcoin-projects-after-coldcard-exploit/","article_id":"2657500995","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/bitcoin-red-team-finds-4962-issues-reviewing-bitcoin-projects-after-coldcard-exploit/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2657500995","pubTimestamp":1785998859,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"A volunteer Bitcoin security initiative has identified 4,962 potential security issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted code reviews, with 720 classified as high or critical severity.Bitcoin Red Team has identified 4,962 potential security issues across 390 Bitcoin projects.According to Bitcoin developer Calle, the Bitcoin Red Team has launched a coordinated security review covering Bitcoin libraries, wallets, infrastructure software and other open-source projects following the recent Coldcard wallet attacks.red teaming bitcoin:– we’ve written multiple harnesses and we’re launching a huge wave of reviews against many core bitcoin projects: crypto libs, wallets, infra, …– situation is extremely bad.– we’re averaging on the order of 1 critical exploit per hour per person. – we’ve…Calle said the work relies on multiple testing harnesses developed specifically for the effort. He also disclosed that the campaign is consuming roughly $10,000 per ","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BTRN":"比特币期货ETF-Global X","ARKB":"比特币ETF-21Shares","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","BTCW":"比特币ETF-Wisdom Tree","BCCC":"Global X Bitcoin Covered Call ETF","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","BITX":"2倍比特币期货ETF-Volatility Shares","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","HODL":"比特币ETF-VanEck","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","MAXI":"比特币期货ETF-Simplify","SBIT":"2倍做空比特币期货ETF-Proshares","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BITB":"比特币ETF-Bitwise","BTCC":"Grayscale Bitcoin Covered Call ETF","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","YBTC":"比特币看涨期权ETF-Roundhill","BTCI":"NEOS Bitcoin High Income ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BETE":"等权重比特币&以太币期货ETF-ProShares","DEFI":"比特币期货ETF-Hashdex","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","BTF":"比特币&以太币期货ETF-CoinShares","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BITI":"1倍做空比特币期货ETF-Proshares","FBTC":"比特币ETF-Fidelity","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BETH":"比特币&以太币期货ETF-ProShares","BTFX":"比特币期货ETF-CoinShares","EZBC":"比特币ETF-Franklin","BITO":"比特币期货ETF-ProShares","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","GBTC":"比特币ETF-Grayscale","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","BRRR":"比特币ETF-CoinShares","BPI":"Grayscale Bitcoin Premium Income ETF","BTCO":"比特币ETF-Invesco Galaxy","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BITU":"2倍做多比特币期货ETF-Proshares","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April"},"translate_title":"比特币红队在冷卡漏洞利用后审查比特币项目时发现 4,962 个问题","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"CBXA":0.6,"DEFI":0.6,"BITI":0.6,"ARKB":0.6,"BPI":0.6,"GBTC":0.6,"BTFX":0.72,"CBOJ":0.6,"FBTC":0.6,"CBTJ":0.72,"BTRN":0.67,"HODL":0.6,"CBOA":0.6,"BITY":0.6,"MAXI":0.72,"SBIT":0.6,"CBTY":0.6,"BFJL":0.6,"BAGY":0.6,"BTCZ":0.72,"BTCO":0.6,"BTF":0.72,"BETH":0.72,"BFAP":0.6,"BTCW":0.6,"CBXY":0.6,"BITU":0.6,"BITO":0.6,"BTCC":0.6,"CBOO":0.6,"YBTC":0.72,"BITX":0.67,"CBOY":0.6,"BTCI":0.72,"CBXO":0.6,"MNRS":0.72,"BITB":0.6,"DFII":0.6,"CBTA":0.6,"BCCC":0.6,"EZBC":0.6,"CBXJ":0.6,"BETE":0.72,"BRRR":0.67,"BTCL":0.72,"XBTY":0.6,"QBF":0.6,"CBTO":0.6},"content_text":"A volunteer Bitcoin security initiative has identified 4,962 potential security issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted code reviews, with 720 classified as high or critical severity.\n\n\nSummary\n\n\n\nBitcoin Red Team has identified 4,962 potential security issues across 390 Bitcoin projects.\nThe volunteer group said 720 findings were classified as high or critical severity.\nMore than one fifth of the reported issues have already been reproduced through verification.\nThe review campaign was launched days after the Coldcard wallet attacks exposed a firmware flaw.\nThe team said it has already reported several critical vulnerabilities to affected projects.\n\n\n\nAccording to Bitcoin developer Calle, the Bitcoin Red Team has launched a coordinated security review covering Bitcoin libraries, wallets, infrastructure software and other open-source projects following the recent Coldcard wallet attacks.\n\nred teaming bitcoin:– we’ve written multiple harnesses and we’re launching a huge wave of reviews against many core bitcoin projects: crypto libs, wallets, infra, …– situation is extremely bad.– we’re averaging on the order of 1 critical exploit per hour per person. – we’ve… https://t.co/9zlaaObU03— calle (@callebtc) August 4, 2026\n\nThe volunteer effort includes AnchorWatch CEO Rob Hamilton and other Bitcoin contributors using AI-assisted tooling alongside manual verification to identify software vulnerabilities.\nIn a post on X, Calle said the group is “averaging on the order of 1 critical exploit per hour per person” and had already reported critical vulnerabilities to several projects within the previous 12 hours. He also described the security situation as “extremely bad.”\n\nSource: X/Calle.\nThe campaign comes less than a week after attackers exploited a flaw affecting vulnerable Coldcard hardware wallet firmware, an incident that has prompted developers and researchers to intensify reviews of Bitcoin software.\nBitcoin Red Team has expanded reviews across Bitcoin projects\nAccording to data shared by Calle, the initiative has completed automated and manual reviews across 390 repositories, identifying 4,962 potential issues in the process. Of those, 720 have been classified as high- or critical-severity findings.\nThe team added that 21.4% of reported issues have already been reproduced, indicating that a portion of the initial AI-generated findings have been independently verified.\nRather than focusing on a single application, the review campaign spans cryptographic libraries, wallet software, infrastructure components and other projects that form part of the Bitcoin ecosystem.\nCalle said the work relies on multiple testing harnesses developed specifically for the effort. He also disclosed that the campaign is consuming roughly $10,000 per day in computing costs, with OpenSats covering the expenses. According to his post, Kimi Moonshot has supplied AI accounts and access to its Kimi K3 model to support the reviews.\nThe group has also asked community members to contribute computing accounts or digital tokens to sustain the initiative.\nColdcard exploit has intensified Bitcoin security efforts\nThe review effort follows one of the largest known wallet security incidents affecting Bitcoin users in recent years.\nAs previously reported by crypto.news, Galaxy Research has confirmed that attackers stole 1,596 BTC from approximately 7,300 addresses across three confirmed attack waves, while also identifying 14 smaller incidents linked to the same Coldcard seed-generation flaw. \nThe research firm has separately identified a suspected fourth coordinated wave that could raise total losses to about 2,055 BTC, although it has not yet included those addresses in its confirmed tally because additional victim confirmation is still pending.\nEarlier blockchain analysis by Galaxy estimated the suspected fourth wave involved 448.7 BTC moving from 709 likely victim addresses, though the firm cautioned that blockchain analysis alone cannot conclusively identify every victim or prove whether a single operator carried out every theft.\nInvestigators have also found that about 90% of the stolen Bitcoin has remained unmoved. In separate on-chain activity reported this week, analysts observed another attacker beginning to route 64 BTC through a Bitcoin mixer, while the largest known attacker has continued holding 1,159 BTC across seven addresses without transferring the funds.\nColdcard vulnerability traced to 2021 firmware error\nAccording to Coinkite, the Coldcard vulnerability originated during a firmware change introduced in March 2021 while integrating a new cryptographic library.\nInstead of generating wallet seeds with the intended hardware random-number generator, vulnerable firmware versions relied on a deterministic pseudo-random generator provided by MicroPython during seed creation.\nBlock’s Bitcoin engineering and security team independently reached the same conclusion after reviewing the firmware. While Block said it had not completed empirical testing across every affected device, it concluded that vulnerable firmware called the deterministic fallback instead of the STM32 hardware random-number generator when creating wallet seeds.\nCoinkite estimates affected Mk2 and Mk3 devices generated roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q devices produced approximately 72 bits instead of the intended 128 bits.\nEmergency firmware updates have since been released for all affected products. The company has also warned that installing patched firmware does not secure wallets created with vulnerable versions. Users must generate entirely new seed phrases on updated devices and transfer their Bitcoin to addresses derived from those new seeds.\nWallets created using at least 50 private dice rolls are not considered vulnerable to this specific random-number-generation issue alone, although Coinkite continues to recommend migration.\nBitcoin developers continue reporting vulnerabilities\nWhile the Coldcard investigation remains active, Bitcoin Red Team said it has continued submitting newly identified vulnerabilities to affected software projects as reviews progress.\nAccording to Calle, several critical issues were disclosed privately to project maintainers within the previous 12 hours instead of being released publicly. The group has not identified the affected projects while developers work on fixes.\nThe volunteer campaign combines AI-generated findings with human review before reporting issues, and the team said reproducing reported vulnerabilities remains part of its verification process. Of the nearly 5,000 potential findings identified so far, just over one-fifth have already been reproduced, while reviews continue across additional Bitcoin repositories.\n\n\n\n\n\n                Read more:\n            \n\n                Putin signs law opening regulated crypto trading in Russia","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2657500995","isCrawlerRequest":true}