A volunteer collective has leveraged AI agents to audit the codebases of 390 Bitcoin-related projects, filing a total of 4,962 security findings. Of those, 720 are classified as high severity or critical, signaling a significant vulnerability landscape in the Bitcoin ecosystem.
AI agents in the security stack
The group deployed automated AI agents to scan codebases for common vulnerabilities, logic errors, and security flaws. The approach allowed them to cover a wide range of projects — from wallets and exchanges to layer-2 protocols and infrastructure tools — without relying on manual review for every line of code. The findings were then triaged and filed with the respective project maintainers.
By the numbers
Of the 4,962 total findings, roughly 14.5% were rated critical or high severity. That means 720 bugs that could potentially lead to loss of funds, denial of service, or other serious exploits. The remaining findings cover medium and low-severity issues, including code quality improvements and potential edge cases.
What the findings mean
The sheer volume of critical bugs across 390 projects suggests that many Bitcoin-adjacent codebases are under-audited. Small teams often lack the budget for professional security reviews, and even well-funded projects can miss subtle flaws. The volunteer group's work provides a free, large-scale audit that developers can act on — but the onus is now on each project to patch the reported issues.
For the Bitcoin ecosystem, this is a reminder that security is a moving target. AI-assisted auditing can scale coverage, but it doesn't replace human judgment. The group plans to continue scanning new projects and updating existing findings as codebases evolve.
