Volunteer Bitcoin Red Team Says Frontier AI Flagged More Than a Dozen Critical Vulnerabilities

A volunteer security initiative working to establish a Bitcoin "red team" says frontier AI models helped it uncover more than a dozen vulnerabilities across core Bitcoin-related projects, underscoring an emerging AI arms race in crypto security. AnchorWatch CEO Rob Hamilton, one of the organizers, said on X that the group has spent about $20,000 so far on AI services while building its red-team platform. He added that funding is secured and donations are not needed. According to Hamilton, the team used multiple high-end models to automate code review and vulnerability discovery, including Kimi K3, OpenAI's GPT Sol, Anthropic's Claude Fable and Opus, and Z.ai's GLM 5.2. He also said the group worked with OpenAI to run a "Cyber Harness" for heavier and more expensive scans, describing the added cost as justified for "load-bearing portions of the Bitcoin ecosystem." In total, the initiative scanned roughly 150 repositories. It has not named the affected projects or released technical details. Pseudonymous Bitcoin developer Calle, another participant, said the effort has built several AI-powered review systems focused on wallets, cryptographic libraries, infrastructure and other Bitcoin software. Calle wrote on X that the team is averaging "on the order of one critical exploit per hour per person," and said critical issues were reported to several projects within a 12-hour window. He also cautioned that the work is costly: "We're burning through $10,000 per day." The update highlights how quickly AI is reshaping both offensive and defensive security in crypto. AI-assisted audits can surface severe bugs faster and at scale, but the same tools can also accelerate attacker workflows. Recent incidents have added weight to those concerns. Earlier this year, researchers using Anthropic's Claude Opus 4.8 reportedly identified a four-year-old Zcash flaw that could have enabled the creation of counterfeit ZEC. In August, Coldcard maker Coinkite said it believed attackers used AI to identify a Coldcard vulnerability. Bitcoin bridge Boltz suspended swaps, citing that attackers were using AI to find vulnerabilities faster than the team could patch them. The volunteer red team's results reinforce a broader trend: as Bitcoin and adjacent projects rely ever more on software and cryptography, automated, AI-driven scrutiny is becoming an increasingly important—and expensive—layer of defense. For now, the specific flaws and the identities of the affected projects remain confidential.