Three stories landed in the same 72-hour window, and together they describe a regime change in crypto security:

  • A 16-person volunteer squad called the Bitcoin Red Team, funded with roughly $40,000 in AI tokens, filed 4,962 security findings across 390 open-source Bitcoin projects in 27.5 hours — 85 critical and 635 high severity [1][2].
  • Boltz, a non-custodial Bitcoin swap bridge, suspended operations indefinitely because automated, AI-assisted attackers were finding and exploiting bugs faster than its small team could patch them [4][5].
  • Ledger CTO Charles Guillemet warned that AI lets attackers scan code and uncover vulnerabilities “at machine speed,” and that “open source and reviewed are not the same thing” [6][7].

Attackers now iterate at machine speed. Defenders still patch at human speed. The gap between those two clocks is the story.

The audit that broke the triage model

The Bitcoin Red Team sprint ran August 4–5, 2026, as a direct response to the Coldcard hardware-wallet RNG exploit [2][3]. Led by Cashu creator calle and AnchorWatch CEO Rob Hamilton, the volunteer group leaned on AI-driven analysis tooling paid for by OpenSats, a nonprofit that funds open-source Bitcoin development [2][3]. The team used frontier models — Kimi K3, GPT Sol, Fable, Opus, and GLM5.2 — through a custom harness that at one point stood at 171,599 lines of code, designed to identify high-load-bearing Bitcoin software, document vulnerabilities, reproduce them, and package the proof for engineers [3].

The numbers, per calle’s first situation report [1][3]:

27.5 hours  | 390 projects      | 4,962 findings
85 critical | 635 high severity | ~180 findings/hour
2.31 high+critical findings per person per hour
91% of findings arrived via automated scan intake
~21% dynamically reproduced with proof-of-concept code
19 of 390 projects had findings disclosed upstream
8 findings retired as false positives

Two numbers deserve a second look.

91% automated intake. Most of the findings were never touched by human hands on the way in. Contributors prompted their agents differently and turned up different bugs — calle noted that letting everyone use their own review method “has proven to be the most effective strategy” [1]. Diversity of prompting is a feature, not a bug.

~21% reproduced. Only about a fifth of findings had been dynamically reproduced with proof-of-concept code at the time of the report [1]. That is not a criticism of the team — it is the defining property of AI-speed discovery. When you generate 180 findings an hour, reproduction becomes the bottleneck. The severity mix tells the same story: privacy and coinjoin tools had 24% of findings rated high-or-critical, swaps and exchanges 21%, while cryptographic libraries produced the largest raw volume (1,101 findings) but only 10% cleared the high bar [1]. Volume without verification is noise with a severity label.

The team followed responsible disclosure — reproducing critical issues locally before notifying maintainers privately — and plans to open-source the harness so companies can run it against their own closed-source code [2][3]. The tooling is coming either way.

Boltz: the bridge that shut itself down

Boltz, the non-custodial service connecting Bitcoin mainchain to Lightning Network and the Liquid sidechain, pulled the plug on August 3, 2026 [4][5]. The company’s own words are the clearest statement of the new threat model:

“To be clear: this is not a response to a single incident. Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch.” [4]

No user funds were lost — Boltz’s atomic swap architecture kept users in control of assets until a swap completed, and the Refund API remains operational for pending transactions [4][5]. But the operational losses were real, and the company concluded it “cannot responsibly re-enable Boltz swaps” while being “actively targeted by what appear to be multiple resourceful groups” racing to deploy fixes [4]. Wallets like Aqua and Bull Bitcoin, which relied on Boltz’s backend for Lightning and Liquid functionality, are now scrambling for alternative providers [5]. Boltz held roughly $262,000 in total value locked at the time [4]. The damage was not a $100 million exploit; it was a small team being out-iterated until the only safe move was to stop.

The Coldcard backstory: a five-year-old bug, found at machine speed

The Red Team sprint and Boltz’s shutdown both trace back to the Coldcard incident. On July 31, 2026, Coldcard reported that a firmware bug had weakened seed generation in some devices [6][11]. The mechanics are instructive: a guard checked whether a config macro was defined, not whether it was enabled, so the build silently fell back to a software generator seeded from the chip’s serial number and timer — values an attacker can reconstruct [6]. Older devices were effectively deterministic; current ones were capped near 32 bits of entropy, about four billion possibilities, against a seed space advertised as 128 bits [6]. Per Coinkite’s advisory, Mk2/Mk3 firmware 4.0.1 (March 2021) through 4.1.9 is affected, and Mk4, Mk5, and Q devices generated seeds with about 72 bits of entropy instead of the expected 128 [11]. Researchers estimate more than 1,000 BTC drained from roughly 1,200 wallets [6], with losses nearing $130 million [10]. The flaw sat in public code for over five years — and Coinkite noted it was likely that “someone used AI to review previous versions of our firmware” [1][6].

That is the sentence that should worry every crypto developer. The bug was public. The code was open. The review was the missing piece, and an AI-assisted adversary supplied it.

Ledger’s response doubles as a defensive blueprint. Guillemet pointed out that the exact failure mode — a biased or deterministic random number — is written down as Threat #1 in Ledger’s published security targets, answered by a certified hardware TRNG (AIS-31, PTG.2, inside a Common Criteria EAL5+/EAL6+ Secure Element) [6]. And Ledger is not sitting still: the company says it makes heavy use of LLMs to hunt vulnerabilities in its own products through an internal harness called Cerberus — “The adversary is already doing this at machine speed. So do we, before they do.” [6]. His warning about the patched-to-weaponized window is the operational takeaway: with modern LLMs, “rediscovering vulnerabilities, understanding patches, and building exploitation pipelines has become dramatically easier. The window between ‘patched’ and ‘weaponized’ is shrinking” [6].

MetaMask Agent Wallet: policy-enforced delegation as the defensive pattern

While the attackers were getting faster, the defensive side got its first mainstream pattern. MetaMask launched Agent Wallet for general availability on August 6, 2026 — a self-custodial wallet purpose-built for AI agents, after an early-access program that began June 8 [8][9]. The design answers a specific question: how do you let an agent act on your behalf without handing it unchecked control?

The answer is enforcement at the wallet layer. Agent Wallet lets users set spend limits, allowlist protocols, and risk preferences before the agent acts [8]. Guard Mode, the default, enforces daily spending caps and allowlisted protocols on every action, and any transaction outside policy pauses for 2FA approval via MetaMask Mobile or an email link — the agent cannot bypass the check [8]. Beast Mode is an opt-in that reduces approval interruptions, but flagged or malicious transactions still trigger 2FA [8]. Supported EVM transactions pass through a security pipeline: transaction simulation before signing, Blockaid threat scanning, and MEV protection, with Transaction Protection coverage up to $10,000 per month for eligible losses that slip through [8]. Agents connect through frameworks like Claude Code, Codex, OpenClaw, Hermes, OpenCode, and Cursor, and can execute ERC-7821 batch swaps without holding a native gas token [8].

The pattern generalizes beyond MetaMask. The wallet acts as a policy enforcement point between an autonomous actor and the money. An illustrative policy for an agent wallet — modeled on Guard Mode’s defaults — looks like this:

{
  "agent": "arb-trader-v1",
  "mode": "guard",
  "spending": {
    "dailyCapUsd": 500,
    "maxPerTxUsd": 100,
    "currency": "USDC"
  },
  "allowlists": {
    "protocols": ["0xUniswapV3Router", "0xAaveV3Pool"],
    "chains": ["1", "8453"]
  },
  "execution": {
    "simulate": true,
    "threatScan": "blockaid",
    "mevProtection": true
  },
  "humanApproval": {
    "requiredFor": ["flagged_tx", "outside_policy", "new_protocol"],
    "fallback": "2fa_email"
  }
}

This is the shape of the defensive answer: the agent gets autonomy, but the blast radius is bounded by policy, and the human retains a veto on anything outside it. Boltz could not bound its blast radius — its entire swap service was the attack surface, and a small team cannot out-iterate an AI adversary on an open codebase.

What this means for crypto developers

The events of the last week compress into five practical changes:

1. Assume your public repo is being scanned continuously. Open source is a double-edged sword: code anyone can inspect is code any AI can scan. “Open and reviewed are not the same thing” [6][7]. If your project’s security posture is “nobody has looked at this,” assume that changes this quarter. The Bitcoin Red Team plans to open-source its harness [2][3]; the same tooling will run against your repository whether you invite it or not.

2. Triage is now a first-class engineering problem. When AI audit tooling can produce 4,962 findings in a day but only ~21% are dynamically reproduced, the bottleneck moves from discovery to verification [1]. Every serious project needs an automated triage pipeline: reproduce findings in a sandbox/regtest, deduplicate, score by exploitability, and route only confirmed issues to humans. The Red Team itself encouraged maintainers to use AI tools to reproduce and validate reports — “validation is now nearly free with AI” [1].

3. Compress the patch-to-deploy cycle. The window between “patched” and “weaponized” is shrinking [6]. Shorter disclosure timelines, faster patching, and migration strategies that assume capable AI-assisted attackers are now part of the security model, not optional improvements [6]. If your deploy pipeline takes days, your patch cadence is a liability.

4. Bound the blast radius with policy-enforced wallets and keys. The MetaMask pattern — daily caps, protocol allowlists, simulation, human veto — is the template for agent-facing infrastructure [8]. Apply the same thinking to your own services: separation of duties between keys, per-operation limits, circuit breakers. Boltz’s atomic-swap architecture saved user funds precisely because no single component had unilateral control [5]. Design so that a compromised component can’t drain everything.

5. Treat randomness as a first-class security function. The Coldcard bug was a five-year-old, publicly visible RNG failure that an AI-assisted adversary reportedly found first [1][6]. Entropy generation needs certified hardware sources, no software fallback paths, and published security targets that name the failure modes explicitly [6]. If your codebase has a “fallback RNG” anywhere, that is a finding waiting to be filed.

The uncomfortable summary: AI turned vulnerability discovery into a commodity, and the Bitcoin Red Team just proved a $40K volunteer budget can out-scan most of an ecosystem [2][3]. The teams that survive the next year will be the ones that stop treating security as a human-speed review process and start treating it as a machine-speed pipeline with humans on triage — and that architect their systems so that even a missed bug cannot take everything with it.

Sources

[1] Bitcoin AI Security Audit Files 4,962 Findings Across 390 Projects — Decrypt, Aug 5, 2026 [2] Bitcoin Red Team files 4,962 findings in 27.5 hours during massive open-source audit — Crypto Briefing, Aug 5, 2026 [3] Bitcoin Red Team Finds 85 Critical Flaws Across 390 Open Source Repos After Coldcard Exploit — Bitcoin Magazine, Aug 5, 2026 [4] This Bitcoin Bridge Shut Itself Down Because AI Was Finding Bugs Too Fast — Decrypt, Aug 4, 2026 [5] Boltz Bridge shuts down swap services indefinitely after AI-powered exploits overwhelm its team — Crypto Briefing, Aug 4, 2026 [6] The Coldcard Incident: How Did This Happen? — Ledger blog, Charles Guillemet, Aug 2026 [7] Ledger Says Coldcard Exploit Shows Bitcoin Wallet Security Must Adapt to AI — Decrypt, Aug 5, 2026 [8] MetaMask Agent Wallet is now live: self-custodial AI trading — MetaMask, Aug 6, 2026 [9] MetaMask Launches Self-Custodial AI Wallet for Autonomous Crypto Trading — Decrypt, Aug 6, 2026 [10] Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M — Decrypt, Aug 2026 [11] Coldcard Security Advisory (Mk3 seed generation warning) — Coinkite, updated Aug 1, 2026

← Back to all posts