Bitcoin Red Team: How Enterprises Are Using AI to Audit Open-Source Dependencies and Secure Critical Code

In late July 2026, Bitcoin started moving out of Coldcard hardware wallets that had been inactive for years. Within a week, an attacker drained about $116 million from more than 5,200 addresses without ever touching the devices.

The problem came from a 2021 firmware bug that caused some Coldcard wallets to generate seeds with weak randomness. According to Fortune’s report, CoinKite advised users who had created wallet seeds on Coldcard devices to move their funds.

That incident pushed a group of Bitcoin developers and security researchers to look deeper into the open-source software behind the ecosystem. They formed the Bitcoin Red Team and started using AI models to review hundreds of projects for similar security flaws.

The same idea applies to your enterprise. If your systems depend on open-source code that your team did not build, AI-assisted security review can help you find hidden risks before they become a real incident.

What is the Bitcoin Red Team?

Bitcoin Red Team is a community of Bitcoin developers, security researchers and builders. The group looks for weaknesses in Bitcoin’s open-source infrastructure so problems can be found before attackers get the chance to exploit them.

Why the Bitcoin Red Team emerged

AI became much better at reading code in 2026. That made it easier for attackers to study unfamiliar software and search for bugs. The Coldcard hack showed how much damage one missed flaw could cause.

Bitcoin developers started using the same AI tools to find those weaknesses first. According to Decrypt’s Red Team report, the group had already scanned about 150 Bitcoin repositories by August and made more than a dozen vulnerability disclosures.

What the Bitcoin Red Team is protecting

The team reviews the open-source software that you rely on across the Bitcoin ecosystem. That includes Bitcoin Core as well as wallets, Lightning apps and transaction-signing libraries.

Coldcard shows why this work matters and SecurityBrief UK reported that the firmware flaw had gone unnoticed for five years. Kevin Loaec of Wizardsardine is set to explain that bug at the Bitcoin Red Team event in Lugano on 22 October.

What Bitcoin Red Team tells us about open-source security

The Bitcoin Red Team highlights a risk your security team already deals with. Your applications depend on code that your developers did not write and may never review in full.

Critical software depends on code teams did not write

Your applications rely on open-source libraries, frameworks and vendor SDKs that your team may never review in full. Many of these components also bring in transitive dependencies that sit several layers below your own code. 

That creates a much larger attack surface than your repository alone. As SC World reported, audited codebases carried an average of 581 open-source vulnerabilities and 44% contained at least one critical vulnerability.

Open-source visibility does not eliminate security risk

Public code gives more people the chance to review it, but that does not mean every weakness gets found quickly. Widely used projects can still carry serious flaws for years before someone identifies the right attack path. Log4Shell made that clear when a critical flaw surfaced in the widely used Log4j library. In its Log4j security guidance, CISA urged organizations to identify every affected system across their environments. The Coldcard case shows why the same level of scrutiny matters for critical Bitcoin code.

Security review needs to become continuous

Your codebase changes every time a dependency is updated or new code reaches production. Each change can introduce a weakness that was not present during your last audit. That is why security review cannot stop after a single assessment. The EU Cyber Resilience Act also reflects this approach by requiring manufacturers to manage vulnerabilities throughout a product’s support period.

How AI is changing open-source code auditing

The table shows how AI is changing open-source code auditing for your enterprise.

How enterprises are using AI to audit open-source dependencies and secure critical code

Below are some of the practices enterprises are using to audit open-source code and protect the parts that matter most.

Auditing open-source dependencies beyond known vulnerabilities

Your team probably runs a dependency scanner that checks package versions against known CVEs. That scan tells you a package has a known issue but not whether your code uses the risky part. AI-assisted review reads the dependency code next to your own code. You can then see if the flaw is reachable and catch issues that have no CVE yet.

Reviewing critical first-party and third-party code

Dependencies are only one part of the risk. The code your developers write and the code your vendors ship can carry the same kinds of flaws. It makes sense to point AI-assisted review at the areas where one mistake does the most damage.

• Authentication and authorization logic that decides who gets in and what they can do.
• Cryptographic functions where a small error can weaken every key or signature they produce.
• Code that stores or moves sensitive customer and financial data.
• Infrastructure code that defines your cloud permissions and network access.

Investigating attack paths instead of isolated findings

A scanner usually tells you whether a dependency has a known vulnerability. The more useful question is whether an attacker can reach that weakness through your app and what they could do once inside. Looking at the whole repository together answers that question. You might find that a risky function is only reachable by an admin or that anyone on the internet can call it, and those two cases need very different fixes.

We at Prem AI built Prem CyberScan to run this kind of review across your repositories on a continuous basis. It maps your codebase and traces possible attack paths before giving you a prioritized list of critical findings with file-level evidence.

What enterprises can learn from the Bitcoin Red Team

The Bitcoin Red Team's approach gives your security team a few clear lessons to act on.

What Bitcoin Red Team signals about the future of software security

The Bitcoin Red Team shows how security review is starting to change. Your team can use AI to examine more code and investigate potential weaknesses faster while keeping human review at the center.

This approach matters beyond Bitcoin. Your enterprise also depends on applications and open-source components that keep changing, so security review needs to keep pace with those changes. 

That discussion is continuing in Lugano this October. Prem AI is powering the Bitcoin Red Team event, where Bitcoin developers and security researchers will discuss current attacks and the security gaps that still need attention.

Join Prem AI at the Bitcoin Red Team event

If you work on Bitcoin infrastructure or open-source security, this event gives you a chance to hear how researchers are dealing with the attacks happening now. The agenda covers recent Bitcoin security incidents alongside continuous audit scanning and the Coldcard bug. Prem AI is also running a hands-on CyberScan workshop.

The event is powered by Prem AI and brings Bitcoin developers together with security researchers and ecosystem builders in Lugano. You will get a closer look at where the biggest security gaps still exist and how teams are using AI to find them earlier.

If you are responsible for securing critical code or open-source infrastructure, you can request your spot for the Bitcoin Red Team event. Seats are limited and registrations are reviewed.

Request your spot and we’ll see you at the event!!

Frequently asked questions about Bitcoin Red Team

What is the Bitcoin Red Team?

Bitcoin Red Team is a community-led security initiative focused on finding weaknesses across Bitcoin’s open-source infrastructure. You can think of it as a proactive defense effort where developers and security researchers use AI-assisted analysis to identify vulnerabilities before attackers get the chance to exploit them.

Why does the Bitcoin Red Team matter for enterprise security?

The Bitcoin Red Team shows how you can use AI to review critical code more continuously. The same approach applies to your enterprise because your applications depend on open-source libraries and third-party components that may contain weaknesses your team has never reviewed directly.

How can AI help you audit open-source dependencies?

AI can help you understand how a dependency behaves inside your application rather than only checking its version against known vulnerabilities. You can use it to examine suspicious code paths and identify areas that need deeper investigation from your security team.

Can AI find vulnerabilities that traditional dependency scanners miss?

AI-assisted review can help you investigate weaknesses that are not captured by a known CVE or vulnerable package version. It can examine code context and relationships across files. You should still combine it with traditional scanning and expert security review.

Why should you continuously review open-source code?

Your codebase changes whenever you update a dependency or release new software. A security review only reflects the code that existed at that moment. Continuous review helps you identify new weaknesses as your application and its dependencies continue to change.

How can you secure critical enterprise code with AI?

You can use AI to map your repositories and investigate sensitive parts of your application. It can help your team trace potential attack paths and prioritize findings with supporting evidence. Human security experts should still validate each finding before remediation decisions are made.