Anyone can now afford to audit the code they depend on. That’s the easy part — and it’s not where the shortage is anymore.
For five years, a Coldcard hardware wallet could generate a private key that a stranger could guess.
The bug was mundane. A March 2021 firmware release set a build flag called MICROPY_HW_ENABLE_RNG to zero. A supporting library checked whether that macro existed rather than whether it was enabled, so seed generation quietly fell through to a software pseudo-random generator seeded from the chip’s serial number and timer registers instead of the hardware entropy source. On older devices, effective key strength dropped from a designed 128 bits to somewhere around 40. Brute-forceable.
Nobody noticed until an attacker started sweeping wallets on July 30, 2026. Estimates of the damage vary by methodology — TRM Labs puts confirmed losses around 1,816 BTC, Galaxy Research has tracked figures approaching 2,055 BTC across multiple waves — but every version of the number starts with “over a hundred million dollars.”
The firmware was open source the entire time.
“Many eyes” was always a claim about permission, not labour
Eric Raymond’s line — given enough eyeballs, all bugs are shallow — has carried the security argument for free software for nearly three decades. It quietly assumes the eyeballs show up.
The record says otherwise, consistently. Heartbleed sat in OpenSSL for two years and surfaced only when two funded security teams went looking. Log4Shell survived roughly eight years in one of the JVM ecosystem’s most-deployed dependencies before an Alibaba Cloud researcher pulled the thread. The xz backdoor — engineered specifically to survive source inspection — was caught because a PostgreSQL developer noticed his SSH logins running 500 milliseconds slow and refused to let it go.
Not one of those was found by the reading public. Each was found by a specific, motivated, technically capable person or team who chose to look. Readability is a property of a file. Review is work someone does. Open source solved the first problem completely and then spent thirty years assuming it had solved the second.
Finding bugs got cheap, fast
The thing that actually changed in the last two years is that the capability to review security-critical code stopped being scarce.
The numbers are no longer speculative. Anthropic’s public coordinated disclosure dashboard recorded 2,300 vulnerabilities disclosed across 392 open-source projects as of late August 2026, with over 90% of externally triaged findings validated as genuine. Google’s Big Sleep found a previously unknown exploitable memory bug in SQLite back in 2024. In August 2026, sixteen volunteers calling themselves the Bitcoin Red Team filed 4,962 findings across 390 repositories in a 27.5-hour sprint — 85 critical, 635 high severity — on about $40,000 of donated compute.
Run that math down to individual scale and the excuse most of us have used since forever (“I can’t read C, so I can’t help”) stops working. A focused audit pass over a mid-size repository runs a couple million input tokens and maybe a hundred thousand output. At current API rates — Sonnet 5 at $2/$10 per million, Opus 5 at $5/$25 — that’s somewhere between a sandwich and a decent lunch. Continuous review of every incoming pull request for a month lands in streaming-subscription territory.
Point that at the firmware holding your savings and the cost-benefit is not close.
But the shortage moved downstream
Here’s the part I think gets underweighted, and it’s why “just run scans on everything” is bad advice.
Go back to the Red Team sprint. Nearly 5,000 findings in a day. At the ~30-hour mark, only about 21% had been independently reproduced, and fewer than 5% of the affected projects had received an upstream disclosure. Look at Anthropic’s ledger from the same angle: 2,300 findings disclosed, 1,815 acknowledged by maintainers, 421 actually patched.
Finding is now the cheap step. Reproducing, triaging, prioritising, patching, and shipping are all still done by humans, and their throughput hasn’t changed at all.
curl is the cautionary tale here, and it’s more interesting than the version most people repeat. Daniel Stenberg killed the project’s bug bounty on January 31, 2026, after the confirmed-vulnerability rate collapsed from above 15% historically to under 5% — buried, in his framing, under reports that read as technically fluent and contained nothing. The bounty had paid out over $100,000 for 87 real vulnerabilities across six years. Killing it was about removing the incentive to submit unverified output.
What happened next is the part worth knowing: curl returned to HackerOne about a month later, without a bounty. The volume hadn’t dropped. The quality had risen. Stenberg’s problem was never AI finding bugs — he’s publicly praised researchers who used AI tooling well. His problem was people forwarding generated text they hadn’t checked, transferring their verification cost onto four unpaid maintainers.
That distinction is the whole game now. A plausible narrative costs nothing to produce. A reproduced finding costs something. Only one of them is a contribution.
So how do you actually help
Pick one project you depend on and can’t read. The firmware signing your transactions. The library terminating your TLS. The client holding your messages. Depth beats breadth — you’re trying to add a perspective that isn’t already there, not to re-scan what sixteen well-funded volunteers already scanned.
Run the first pass manually. Hand the repository to whatever agent you already use and ask for a security review, letting it propose its own methodology. Read what comes back with suspicion. Your first pass will teach you more about tuning your prompt than about the codebase.
Then spend most of your budget on verification, not discovery. This is the inversion. When something looks real, point the agent back at it with adversarial instructions: reproduce it against a real build, write the failing test, trace the input path to a specific file and line, check whether an existing issue already covers it, then argue the maintainer’s side and try to kill it. Most candidates die there. That’s the point — every false positive you eliminate is maintainer time you didn’t burn.
File what survives, with the receipts. The test, the trace, the proof of concept, the exact location. Nothing else.
Make sure your setup is weird. Knight and Leveson demonstrated back in the 1980s that independently written implementations still fail in correlated ways — independence of effort doesn’t buy independence of failure modes. Ten people running the same model with the same prompt are one auditor. Different models, different harnesses, different questions, different obsessions: that’s what coverage means. The xz backdoor fell to one person’s peculiar setup and a stopwatch.
Consider helping with the patch. Given where the bottleneck actually is, a verified finding that arrives with a working fix and a regression test is worth several that don’t.
The incentive finally points the right way
The reason this might work where three decades of goodwill didn’t is that it doesn’t rely on goodwill. You want your own wallet to keep working. You want the library holding your messages to hold. Spending twenty dollars a month auditing the code your savings sit behind is aligned self-interest with the price collapsed to nearly nothing — and self-interest, unlike altruism, reliably shows up on a schedule.
Just remember what you’re actually contributing. Not scans. Anyone can generate those now, including the people who swept those wallets in July. What’s scarce is a person who checked.