Bitcoin Red Team Audit Finds 5,000 Vulnerabilities in Open-Source Projects

A volunteer security collective known as the Bitcoin Red Team has filed nearly 5,000 vulnerability reports across hundreds of open-source Bitcoin projects in a rapid audit triggered by a major hardware wallet hack. The effort, which scanned 391 codebases in approximately 30 hours, uncovered 720 high or critical severity issues, though only a fraction have so far been communicated to the developers responsible for fixes.

The security sweep was initiated following a disclosure on July 30 by Coinkite, the maker of the Coldcard hardware wallet. The company revealed that seed generation on affected devices had fallen back to a predictable software routine, allowing an attacker to potentially guess private keys with about 4.3 billion attempts. According to Galaxy Research, confirmed thefts from this flaw reached 1,596 Bitcoin from roughly 7,300 addresses as of August 4, with potential total losses nearing $130 million. The incident pushed active Bitcoin addresses to a 20-month high.

Despite the Coldcard breach being the catalyst, hardware wallets ranked second-lowest for serious flaws at 9.6% of findings. Mining pools had the highest concentration at 21.7%, followed by infrastructure...