About one in seven reported findings were classified as high or critical severity.
A coordinated Bitcoin security campaign uncovered nearly 5,000 software issues across hundreds of open-source projects in about 30 hours. The effort combined human expertise with artificial intelligence tools to identify software weaknesses.
The initiative brought together 16 security researchers led by developer Calle, with support from OpenSats, OpenCode, and AI inference sponsors. The group worked together on a coordinated review covering hundreds of Bitcoin-related projects.
Breaking Down the Findings
According to figures released by the team, researchers reported 4,962 findings across 390 Bitcoin-related projects during the campaign. The total included 85 critical issues and 635 high-severity findings, bringing the number of the most serious reports to 720.
The campaign maintained a rapid pace, averaging about 166 reported findings every hour throughout the review. Based on the published figures, the team identified roughly 2.3 critical or high-severity issues for every person-hour spent examining software.
Researchers said the campaign differed from a traditional security audit because human reviewers actively guided AI systems during testing. Each participant used different prompts and methods, helping uncover weaknesses that a single approach might have missed.
The final tally also included findings collected by one contributor before the live campaign officially began. After those results were added, crypto libraries and software development kits recorded the largest share of findings with 1,385 reported issues.
What the Findings Revealed
The team said that about one out of every seven reported findings fell into the high or critical severity categories. Only one reviewed project reportedly completed the campaign without any reported issues, prompting a lighthearted remark from Bitcoin Core developer Matt Corallo.
You may also like:
Researchers have already started sending verified critical findings to affected project maintainers with supporting proof-of-concept retest demonstrations. Many maintainers reportedly confirmed the reports quickly, although processing such a large volume remains a significant challenge.
The campaign comes as Bitcoin software security receives greater attention across the ecosystem after several recent security incidents. Separately, Bitcoin recorded about 0.98 million daily active addresses on July 31, the highest level since December 2024. The surge came after attackers began sweeping wallets whose seeds were generated using defective Coldcard firmware.
