Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC The Bitcoin Red Team scanned 501 open source projects and found 7,958 security issues.
The Bitcoin Red Team scanned 501 open source Bitcoin projects and found a total of 7,958 security findings, of which 1,280 were rated as high-risk or critical. The intervention of artificial intelligence has greatly accelerated code reviews for wallets, Lightning network software and Bitcoin infrastructure.
25 developers participated in the coordinated review, which lasted 108 hours, combining manual analysis with automation tools and artificial intelligence models. The project relies heavily on Moonshot AI's Kimi K3 and other models, with computational costs funded by OpenSats through its dedicated Bitcoin Red Team program.
These 7,958 findings should not be considered as 7,958 independently confirmed vulnerabilities. Maintainers and researchers must replicate AI-generated findings, determine whether there are available paths, and assess actual severity before releasing patches.
Maintainer verifies key findings
Bitcoin developer Calle said that project maintainers have verified numerous critical and high-risk reports generated during the review. The action has grown rapidly from 4,962 findings covering 390 projects on August 5 to nearly 8,000 findings covering 501 codebases.
Work accelerated because the amount of Bitcoin theft related to Coldcard has exceeded $130 million, exposing weaknesses buried in open source firmware that may go undetected for years until attackers begin exploiting vulnerable wallet seeds.
Calle said unmaintained codebases pose a special problem because AI is able to identify exploitable vulnerabilities but lacks an active development team to investigate or patch them. The same economic principles apply beyond Bitcoin, a risk that Coinbase CEO Brian Armstrong has raised, arguing that AI will make software more secure while reducing the cost of discovering vulnerabilities.
BTCPay Server fixes an exploited Lightning network vulnerability
This review has intersected with an actual security incident. BTCPay Server has patched a critical vulnerability in version 2.4.2 that allows an unauthenticated remote attacker to obtain LND administrator macaroon credentials and potentially control connected Lightning network wallets.
The attacker exploited the vulnerability before the patch was released and stole funds from affected users. BTCPay subsequently awarded Craig Raw 0.21 BTC and Bitcoin Red Team 0.21 BTC in recognition of responsible disclosure and analysis, while introducing a more rigorous code scanning and security review process.
Users running BTCPay Server with LND versions lower than 2.4.2 are required to immediately update and rotate affected credentials.
Coinbase and BitGo jointly call for cutting-edge AI access
More than 40 Bitcoin and digital asset organizations have signed the "Defenders Need Frontier" open letter, requiring major AI laboratories to provide qualified open source security researchers with controlled access to their strongest cybersecurity models.
Signatories include Coinbase, Block, BitGo, Strategy, MARA, Galaxy, Trezor, Blockstream, Anchorage Digital, Brink, Chaincode Labs and OpenSats. The alliance seeks early model access, adequate computing resources, a secure research environment, and direct disclosure channels with AI laboratory security teams.
OpenSats currently operates a special fund to reimburse AI computing costs and reward researchers who responsibly disclose key Bitcoin software vulnerabilities. At the same time, BTCPay Server 2.4.2 is still the necessary fix for the exploited LND credential vulnerability.
