Sixteen Bitcoin developers have filed 4,962 security findings across 390 projects in a little over a day, including 85 critical and 635 high-severity issues, according to Calle, the pseudonymous developer behind the Cashu ecash protocol.
The findings stem from a coordinated audit in which developers pointed AI models at bitcoin wallets, cryptographic libraries and infrastructure. "Situation is extremely bad," Calle noted, adding: "We're ramping up. Much of our work is still manual (hand holding the AI) but our automated harnesses are getting better at the same time. So far, letting everyone use their own favorite review method has proven to be the most effective strategy."
Most critical reports have been quickly verified by project owners and reproduced with a working proof of concept in a local test environment before being sent, Calle said. He acknowledged the volume is creating its own problems, describing "a lot of chaos right now in the ecosystem" and apologizing to maintainers buried in reports as the group works to sort out what he called "the slop."
The team publishes fast because maintainers can now verify findings almost for free using the same tools, Calle said, and because "others who aren't on the red team will arrive at the same findings as we did."
