AI-Fueled Bitcoin Red Team Surfaces Critical Bugs Across Wallets, Libraries, and Infrastructure

A group of volunteer security researchers says AI has started paying real dividends in Bitcoin code review. After scanning roughly 150 Bitcoin-related repositories, the team reports more than a dozen vulnerability disclosures and is now building an open-source platform to automate audits across wallets, cryptographic libraries, and key infrastructure.

AnchorWatch CEO Rob Hamilton, who has been coordinating the effort, outlined the approach on X: the team has spent about $20,000 on AI services to date, secured funding for the next phase, and does not plan to solicit donations. The thesis is simple: bring red-team discipline to Bitcoin’s software stack and let frontier models chew through code paths that humans often miss under time pressure.

The tooling mix reads like a who’s who of current-generation AI: - Kimi K3 - OpenAI’s GPT Sol, plus assistance to run “Cyber Harness” - Anthropic’s Claude Fable and Claude Opus - Z.ai’s GLM 5.2

Hamilton noted that the Cyber Harness runs are expensive yet justified for “load-bearing” components, where any latent bug can compound into systemic risk. That cost profile tracks with what many security teams are seeing: high-quality model ensembles and deep code-context scans are not cheap, but they can surface edge cases and unsafe patterns faster than traditional review.

Speed is the headline. Pseudonymous Bitcoin developer Calle said the initiative has stood up multiple AI-powered review systems and is “averaging on the order of one critical exploit per hour per person,” with several critical reports filed in the last 12 hours. The group estimates a burn rate near $10,000 per day. They have not named affected projects or shared technical details, suggesting they’re following responsible disclosure windows while patches land.

This is not happening in isolation. AI is already reshaping crypto’s defense and offense. Researchers using Anthropic’s Claude Opus 4.8 earlier this year surfaced a four-year-old flaw in Zcash that could have enabled unlimited counterfeit ZEC. In August, Coinkite said it believes attackers used AI to uncover a Coldcard wallet vulnerability. That same month, Bitcoin bridge Boltz halted its swap service, stating adversaries were using AI to find weaknesses faster than its team could close them.

The real story here is the security economics. AI compresses discovery timelines and flips the cost curve: defenders can cover more code with fewer humans, but attackers enjoy the same leverage. When both sides gain acceleration, the deciding factor becomes operational tempo—who patches faster, who triages better, and who maintains better CI pipelines. Claims like “one critical exploit per hour” may include noise or overlapping issues, yet even a fraction of that pace forces maintainers to re-architect their review and release process around machine-augmented triage, continuous fuzzing, and automated patch validation.

There’s also an uncomfortable cultural pivot. Open source has long leaned on “many eyes” to find bugs. In practice, many repositories see sporadic attention, and subtle cryptographic or concurrency failures can hide for years. AI is dissolving that complacency. Wallets, signing flows, and cryptographic libraries now need model-in-the-loop checks in pre-commit, not just post-hoc audits. For load-bearing Bitcoin components, expensive scans like Cyber Harness shouldn’t be a one-off; they need to be scheduled, repeatable jobs tied to release gates.

An open-source AI audit platform could be the right shared defense, if it threads the needle. Publishing tooling and methodology will help maintainers replicate scans and institutionalize fixes. At the same time, shipping turnkey exploit discovery to the internet can arm opportunistic attackers. Sensible guardrails—rate limits, staged disclosures, and contributor verification—will matter as much as model quality. Funding sustainability matters too; a $10,000 daily burn is manageable for a short burst, but long-term resilience likely requires diversified sponsors and lighter-weight, reproducible pipelines.

The takeaway for Bitcoin builders is pragmatic: assume AI adversaries are crawling your repos, and design your development and disclosure workflows accordingly. Treat model-assisted review like unit tests—always on, measured, and continuously improved. The pace of discovery is rising; the teams that adapt their processes, not just their code, will hold the advantage.