Bitcoin Red Team Uncovers Thousands of Vulnerabilities After Coldcard Breach

The campaign, led by Bitcoin developer Calle and AnchorWatch CEO Rob Hamilton, utilizes custom testing harnesses and AI models to scan cryptographic libraries, wallet software, and core infrastructure. The team reports a staggering discovery rate, with participants averaging one critical exploit per hour. To date, over 21% of the flagged issues have been independently reproduced, confirming the validity of the automated findings.

Funding for the $10,000-per-day computing costs is provided by OpenSats, with additional resources supplied by Kimi Moonshot. The effort serves as a direct response to the recent Coldcard incident, which saw attackers siphon over 1,500 BTC due to a 2021 firmware flaw that compromised entropy generation. While developers are privately disclosing critical vulnerabilities to project maintainers to allow for remediation, the sheer scale of the findings suggests a widespread fragility across the open-source ecosystem. Affected projects remain undisclosed as the group prioritizes security patches over public disclosure.