However, the headline figure does not mean that 7,958 confirmed vulnerabilities have been discovered.
Researchers classified 1,280 findings as high or critical, while approximately 24.7% of all findings had been dynamically reproduced at the time of the latest tally. Around 29.4% had also been reported to project maintainers for further review.
That distinction is important because AI-assisted security scanning can identify false positives, duplicate findings and issues whose severity changes after manual analysis.
Calle, a pseudonymous Bitcoin developer involved in the initiative, said on Aug. 13 that the team had completed a basic review of almost the entire Bitcoin open-source ecosystem. Calle's update on X
The latest results suggest that AI can dramatically accelerate the initial discovery phase of open-source security research, while human researchers and maintainers remain essential for confirming vulnerabilities and developing fixes.
Kimi K3 becomes a key tool in the Bitcoin security campaign
Moonshot AI's Kimi K3 has become one of the primary models used during the latest phase of the Bitcoin Red Team's work.
Calle said that roughly two weeks of testing demonstrated how quickly modern AI models can analyze large amounts of older open-source code.
His comments reflect the team's experience with the campaign rather than evidence that Bitcoin Core or the wider Bitcoin network has been compromised.
Independent research provides some evidence that Kimi K3 can perform meaningful cybersecurity tasks.
A joint assessment by the U.K. AI Security Institute and the U.S. Center for AI Standards and Innovation found that Kimi K3 demonstrated notable capabilities in exploit-development testing. The model scored 32% on ExploitBench, although it remained behind leading U.S. closed models and achieved arbitrary code execution on none of the 41 samples used in another test. U.K. AI Security Institute assessment of Kimi K3
The findings suggest that AI can serve as a force multiplier for security researchers, particularly when examining large and diverse open-source ecosystems.
Bitcoin Red Team has dramatically increased its coverage
The latest campaign represents a substantial expansion from Bitcoin Red Team's earlier security review.
An earlier sweep examined 390 Bitcoin-related projects and identified 4,962 potential issues, including 720 that researchers initially classified as high or critical.
The new review covers 501 projects and has produced 7,958 findings, showing how quickly the scope of the campaign has expanded.
However, the increase in findings should not automatically be interpreted as a proportional increase in actual vulnerabilities.
A larger AI-assisted scan can identify more potential issues simply because more code is being examined and automated tools can generate findings at a much faster rate.
The more important stages are now reproduction, severity assessment, responsible disclosure and remediation.
BTCPay Server fixes critical security vulnerabilities
Some findings from the broader security campaign have already resulted in concrete fixes.
BTCPay Server, an open-source Bitcoin payment processor, credited Bitcoin Red Team researchers Bruno Garcia and Ben Carman with reporting a critical vulnerability in its software.
The vulnerability involved a two-factor authentication bypass affecting Greenfield Basic Authentication and was addressed in BTCPay Server version 2.4.2. BTCPay Server releases on GitHub
BTCPay Server subsequently said attackers had obtained LND admin macaroon credentials from affected installations and used them to access connected Lightning wallets.
The project also said it was reviewing additional security reports from Bitcoin Red Team, Project Loupe, Magic Grants and independent researchers.
On Aug. 14, BTCPay Server announced another security-focused release candidate, v2.4.3-rc4, addressing vulnerabilities reported by several security researchers. BTCPay Server on X
These incidents demonstrate why individual findings need to be assessed separately. Some reports can lead to serious vulnerabilities requiring immediate patches, while others may ultimately prove to be false positives or lower-risk issues.
AI-assisted security creates a faster disclosure cycle
The Bitcoin Red Team campaign highlights a broader change taking place across open-source software security.
Traditional security audits can take significant amounts of time because researchers must manually examine code, identify attack paths and reproduce potential vulnerabilities.
AI systems can accelerate the initial process by scanning large codebases and identifying suspicious patterns much faster.
That creates both opportunities and challenges for Bitcoin developers.
Security teams can potentially identify weaknesses earlier, but maintainers may also receive a much larger volume of reports that require manual validation.
Calle has argued that projects with limited maintenance resources could face greater risks as AI makes vulnerability discovery cheaper and faster.
The conclusion is not that every unmaintained Bitcoin project is automatically unsafe. Instead, the changing economics of security research could make regular security monitoring increasingly important.
Bitcoin developers are seeking better access to AI security tools
The ecosystem is also beginning to develop infrastructure for AI-assisted security research.
OpenSats has introduced a fast-tracked red-teaming grant route that can help researchers cover expenses associated with using large language models. OpenSats grants
More than 40 organizations from the Bitcoin and broader digital-asset ecosystem have also called on leading AI companies to provide vetted open-source security researchers with controlled access to advanced models.
The proposal focuses on supervised access rather than unrestricted use, with safeguards such as secure environments, sufficient computing resources and communication channels between researchers and AI security teams.
The objective is to ensure that defenders can use increasingly capable AI systems before attackers gain an overwhelming advantage.
Most findings still need human verification
The biggest limitation of the latest Bitcoin Red Team tally is that 7,958 findings should not be treated as 7,958 confirmed vulnerabilities.
Only a portion of the findings had been dynamically reproduced at the time of the report.
AI-powered security systems can identify legitimate vulnerabilities, but they can also generate:
False positives
Duplicate findings
Incorrect severity classifications
Issues that cannot be reproduced
Findings that require specific configurations to become exploitable
Human researchers therefore remain critical to determining whether an issue is real and understanding its potential impact.
Maintainers must then decide whether a patch is necessary, how widely users may be affected and when technical details can safely be disclosed.
Bitcoin's core protocol is not the focus of the headline number
For Bitcoin users, the findings need to be interpreted carefully.
The Red Team's research covers a broad collection of Bitcoin-related open-source software, rather than demonstrating a failure of Bitcoin's underlying consensus mechanism.
The immediate security implications are more relevant to applications and infrastructure such as:
Bitcoin wallets
Lightning Network software
Payment processors
Libraries
Exchanges and related integrations
Self-hosted Bitcoin infrastructure
A vulnerability in one of these projects can still have serious consequences for users, even when Bitcoin's base protocol continues to operate normally.
What the Bitcoin security review means for users
The expansion of Bitcoin Red Team's campaign shows how AI is changing the economics of open-source security research.
Scanning hundreds of projects can now be performed much faster, potentially allowing researchers to identify weaknesses that might otherwise remain undiscovered.
At the same time, the large number of findings makes verification more important than ever.
The 7,958 findings are a security-research tally, not a count of confirmed exploitable vulnerabilities. The more meaningful indicators will be how many reports are independently reproduced, responsibly disclosed, patched and ultimately confirmed by maintainers.
For Bitcoin users, the most practical takeaway is to keep wallets, Lightning software and other Bitcoin infrastructure updated and to pay attention to security advisories from the projects they use.
The latest Red Team campaign does not indicate that Bitcoin itself has been compromised. Instead, it highlights a growing security race around the software ecosystem built on top of Bitcoin—and the increasing role AI may play on both sides of that race.
