Bitcoin Red Team Files 4,962 Security Findings Across 390 Projects After Coldcard Theft

Sixteen volunteer researchers working as the Bitcoin Red Team, organized by the developer known as Calle and by Rob Hamilton, chief executive of the custody firm AnchorWatch, filed 4,962 security findings across 390 open-source Bitcoin projects during a sprint on 4 and 5 August. The group classified 85 findings as critical and 635 as high severity. It used artificial-intelligence analysis harnesses to read wallet code, cryptographic libraries and node infrastructure faster than manual review allows, and it worked on a $40,000 grant from the funding organization OpenSats. Calle wrote publicly that the team was averaging roughly one critical exploit per researcher per hour.

The sprint followed the Coldcard incident. A firmware integration error shipped in March 2021 sent seed generation on some devices to a deterministic software pseudorandom number generator instead of the hardware random number generator on the device's STM32 chip. The private keys those devices produced were therefore reproducible. Galaxy Research has traced three rounds of thefts totalling about 1,367 bitcoin, close to $89 million at recent prices, from roughly 4,585 addresses.

Most of the stolen coin has not moved. Galaxy said the single largest theft, 1,159 bitcoin, remains untouched, while a separate attacker has begun routing smaller sums through a mixing service, starting with about 10 of 64 bitcoin sent. Investigators have circulated roughly 600 flagged addresses to exchanges, analytics firms and law enforcement.

The commercial assessment came quickly. Analysts at Cantor and FRNT told CoinDesk the breach could push some holders toward regulated custodians and exchange-traded funds. Bitcoin Magazine's editorial argues the opposite, that the failure was one vendor's build process, not self-custody itself. Both conclusions can hold at once. The defect was an implementation error in a certified device, and the practical response for many holders is to pay someone else to hold their keys.