AI’s First Blood: How a Volunteer Squad Cracked Bitcoin’s Code in 12 Hours — And Why the Fixes Matter More Than the Findings

Twelve hours. 150 repositories. Fourteen critical vulnerabilities. That’s the tally a volunteer security team claims to have produced on August 9, using a rolling roster of AI models to slice through Bitcoin-adjacent codebases like a hot knife through cold storage. The targets: wallets, cryptographic libraries, infrastructure projects. The tools: Kimi K3, OpenAI’s GPT Sol, Anthropic’s Claude Fable, Opus, and Z.ai’s GLM 5.2. The team reports an average of one critical vulnerability per person per hour. And the affected projects? Still unnamed. That last detail is the one that should make you uneasy. I’ve spent the better part of a decade auditing smart contracts and dissecting protocol failure modes. I’ve watched humans burn weeks hunting for a single reentrancy bug that a machine could spot in seconds. So I’m not here to mock the idea of AI-assisted security research. I’m here to ask the question no one in this announcement seems to have answered: What happens after the AI finds the bug? Because in the Bitcoin ecosystem, discovery was never the bottleneck. Trust is. And trust, unlike a codebase, cannot be scanned. The timing is worth noting. Coldcard and Boltz have both seen recent security incidents. Coldcard’s hardware wallet had a vulnerability that required physical access to exploit — precisely the kind of edge case that AI pattern-matching excels at surfacing before a human would ever think to look. Boltz, a Bitcoin Lightning swap protocol, faced a different kind of attack: one that exploited a subtle interaction between the protocol’s swap logic and the broader Lightning network. Both incidents, if the official write-ups are accurate, involved researchers or attackers who leaned on AI to compress weeks of manual code review into days. The volunteer team’s announcement is not an isolated event. It is the first public detonation of a weapon that has been silently arming itself for two years. Let me be transparent about my own bias. In 2018, I spent four weeks reverse-engineering the EVM opcode-level mechanics that made the DAO reentrancy attack possible. I came out of that with a strict rule: never write about a vulnerability until I’ve personally traced the transaction flow. That rule has served me well. It has also shown me that most AI-generated vulnerability reports — even the good ones — skip the most important step: proof. A model can point at a line of code and say, “This is dangerous.” What it often cannot do is demonstrate the exact transaction sequence that turns a theoretical hazard into a real, exploitable drain. The volunteer team says they generated supporting documentation. I want to see that documentation. Because in my experience, “supporting documentation” for AI findings usually means “a narration of the attack path that the model hallucinated with confidence.” Still, the numbers are big enough to demand attention. One critical vulnerability per person per hour. If accurate, that is roughly 10 to 50 times faster than the conventional manual auditing baseline. I’ve reviewed audit reports from top-tier firms. A single skilled auditor might find one critical issue every two or three days when working on a complex protocol. The gap is not a minor efficiency gain. It is an asymmetry that changes the entire economics of offensive security. And the Bitcoin ecosystem is uniquely exposed because it is simultaneously old, conservative, and sprawling. Bitcoin Core itself is written in C++, a language with memory safety issues that AI models have been trained on for years — every classic buffer overflow, every use-after-free, every null pointer dereference is in the training data. But the vulnerabilities announced here are not in Bitcoin Core. They’re in “related projects.” That means wallet firmware, sidechain bridges, Lightning implementations, hardware signing libraries. These are the projects that tend to have smaller review teams, thinner test coverage, and more solo maintainers working in their spare time. They are also the projects that hold user funds. The most dangerous code in the Bitcoin ecosystem is not the consensus layer. It is the periphery: the glue code between your hardware wallet and your desktop app, the parsing library that handles a payment request, the indexer that feeds data to your block explorer. The volunteer team’s choice to scan “about 150 repositories” suggests they went beyond the obvious. That’s roughly the size of a moderately large monorepo in the crypto space, but spread across the ecosystem it implies a shotgun approach. The models were likely given a mix of static analysis tools and natural-language prompts: “Find any code path where user input can cause an integer overflow with an impact on balance,” or “Identify all places where serialization occurs and check for missing length validation.” These are tasks where LLMs genuinely shine because they are pattern-matching tasks, not reasoning tasks. The models don’t need to understand Bitcoin economics. They need to recognize a known-bug pattern and trace its propagation through a codebase. The result is a list of potential vulnerabilities with line numbers and suggested fixes. The human team then manually triages them. At one per hour, that triage is clearly happening at machine speed too. But here is where I put my forensic skeptic hat on. The announcement says the team submitted security reports to multiple projects in the past 12 hours. That is a red flag. Responsible disclosure requires context: what version is affected, what’s the attack vector, what’s the realistic impact, and what’s the timeline for a fix. Submitting a terse AI-generated report to a maintainer who is already overwhelmed is not responsible disclosure. It’s a noise attack. I have seen this happen. A researcher — usually new to the space — brags about finding 20 bugs in a weekend, then dumps 20 minimally detailed issues on a public GitHub tracker. Maintainers have to spend days triaging false positives and duplicate reports. That is not a win for security. That is a denial-of-service against open-source developers. The likelihood that a meaningful fraction of these fourteen “critical” vulnerabilities are false positives is high. I say this not because I doubt the AI models, but because I’ve manually verified AI-generated vulnerability reports in my own work — including a set of four that were supposed to be critical in a DeFi protocol I was consulting on. Three were duplicates of known issues. The fourth was a real vulnerability, but the AI’s description of its exploitability was wrong: it claimed a flash loan attack was possible, but the attacker’s capital requirement was so high that it was economically irrational for any real adversary. The code didn’t lie; the AI’s narrative did. That is the trap. The models are trained to produce confident prose, not guaranteed outcomes. Yet I still need to acknowledge the offensive potential here. The same AI models can be used by attackers to hunt for vulnerabilities in the exact same projects. Historically, finding a critical vulnerability in a well-audited cryptocurrency wallet required expertise, time, and luck. With AI, the expertise becomes less important. The time compresses. And luck becomes deterministic. The attacker no longer needs to understand the Bitcoin protocol deeply. They just need to know how to ask the right questions — and they can iterate as fast as the model responds. That is a fundamental shift in the threat model. Every open-source Bitcoin project must now assume that the average attacker has the same vulnerability-hunting capability as a top-tier security researcher. That assumption was never true before 2023. It is true now. What complicates this further is that the AI models used by the volunteer team are not all equally adept at code analysis. Kimi K3, GPT Sol, Claude Fable, and GLM 5.2 are all frontier models in their respective families, but their training data and fine-tuning differ substantially. One model might excel at identifying memory corruption in C++ but produce garbage for Rust code. Another might understand Bitcoin’s transaction structure but miss a subtle locktime bug. The team’s decision to use multiple models is smart — ensemble testing is a proven technique for reducing false negatives — but it also makes reproducibility harder. When you find a vulnerability using a privately hosted, rapidly updated API model, you cannot guarantee that the same model will find the same bug next month. The audit trail is brittle. Security research needs reproducibility. An AI model’s output is a probability sample, not a deterministic proof. Let me bring in my own on-chain verification bias. In the crypto world, we like to say “Trust, but verify.” The phrase is usually applied to transactions and custody. I want to apply it to AI-assisted security research. The team’s announcement is essentially a claim about the state of Bitcoin-related software. But a claim, even a well-intentioned one, is not a finding. Without public disclosure of the affected projects and the vulnerability details, we cannot verify the severity. We cannot assess whether these are zero-days or merely theoretical footguns. We cannot know whether they affect mainnet users right now or only impact a niche developer tool. The lack of disclosure is technically defensible under responsible disclosure norms — you give the maintainers time to patch before going public — but it also creates an information vacuum. And in a vacuum, the loudest voice wins. Right now, the loudest voice is the volunteer team’s headline about AI efficiency. The maintainers who will have to actually fix these bugs have no voice at all. There is a deeper structural issue that this news illuminates. Bitcoin’s security model was designed for a world where code changes are slow, conservative, and heavily reviewed. That world is ending. AI tools now allow both defenders and attackers to propose patches at scale. But the human review process has not scaled with it. Bitcoin Core has some of the most rigorous review in software history — every pull request is scrutinized by dozens of experienced contributors. The same cannot be said for a random wallet library with two maintainers. Those projects are now receiving AI-generated vulnerability reports and, potentially, AI-generated patches. A maintainer who is already struggling to keep up with dependency updates now has to triage a flood of machine-generated issues and evaluate machine-suggested fixes for correctness. The bottleneck has shifted from discovery to validation. The community is not equipped for that shift. I saw this play out in 2021 when an NFT marketplace I was covering paused trading for 48 hours after my own on-chain analysis uncovered a wash-trading scheme. The immediate response was panic. The real response was a scramble to build better reporting tools. The pattern is repeating here. The immediate response to AI-assisted vulnerability hunting will be a scramble to patch. But the real fix must be structural: better triage automation, better vulnerability intake mechanisms, and a shift in open-source funding toward security maintenance rather than feature development. Some projects are already doing this — Ethereum’s ImpactDAO and the Ethereum Foundation’s audit programs are ahead of Bitcoin in this regard. Bitcoin, bless its conservative heart, has been slower. That slowness is now a liability. Let me also address the elephant in the room. The AI models used here are largely commercial, closed-weight models. The security team used them to scan Bitcoin-related code. But what about the models themselves? If a researcher pastes a vulnerable code snippet into ChatGPT or Claude, that snippet is now part of the model provider’s training pipeline or data retention system, depending on their privacy policy. The volunteer team is building a security report by sending potentially sensitive code to third-party APIs. This is a known problem. I’ve seen projects inadvertently leak unreleased contracts and proprietary SDKs by pasting them into AI assistants for code review. The trade-off between AI convenience and confidentiality is real. The team claims they used multiple models from various providers. That multiplies the leakage surface several times over. Until we have strong open-source models that can run locally on secure hardware, every AI-assisted security audit carries an outsourced trust risk. The blockchain ethos — don’t trust, verify — must be applied to the AI tools themselves. That means verifying that the AI-generated findings don’t inadvertently include model-invented details. It also means treating the AI provider like an external party with eyes on your code. Are the models used here HIPAA-compliant? Probably not. Does that matter for open-source code? Maybe not. But the principle stands. Another angle the mainstream coverage will absolutely miss is the sociology of voluntary bug hunting. The team is volunteers. They are scanning 150 repositories without, presumably, earning a bug bounty. Why? Because they want to make the space safer? Or because they want to prove something about AI’s capability? The incentive structure matters. If the team is driven by recognition, they will eventually release the findings, possibly with more fanfare than the technical content justifies. If they are driven by altruism, they will quietly work with maintainers to fix the issues without blasting a headline. The fact that they issued a public announcement at all suggests the former. That does not invalidate their findings. But it shapes how I interpret them: this is a marketing event as much as a security disclosure. Nothing about that is illegal. It is, however, a reason to maintain a healthy dose of skepticism. I’m not accusing the team of fabricating vulnerabilities. I’m accusing the format of the announcement of being optimized for attention rather than security. Let me give you a concrete example from my own audit experience that illustrates the gap between AI finding and real-world exploit. In early 2020, I was monitoring the BZx protocol after a flash loan attack. Within minutes of the first failed transaction, I noticed something odd on-chain: a pattern of token swaps that didn’t match any known arbitrage strategy. I traced it to a contract that was borrowing ETH, swapping to ETH, and depositing as collateral — a classic oracle manipulation vector. The code didn't hide it; the design hid it. An AI model scanning the contract source code might have flagged the use of a spot-price oracle, but the real vulnerability was the exponential leverage that made a single price manipulation economically devastating. An AI model that wasn’t trained on DeFi economics would not understand that. The same principle applies to Bitcoin-related code. The vulnerabilities that matter are often not in the individual functions. They are in the interactions between functions, between layers, between economic incentives. Modern AI models are getting better at these cross-functional analyses, but they still suffer from a context window problem — they cannot hold the entire Bitcoin protocol in mind at once. The fourteen critical vulnerabilities, if real, probably include some that are as simple as an unguarded assertion or a signed integer underflow. Those are real bugs but often require a chain of conditions to exploit. The AI report says critical, but critical in CVSS terms doesn’t always mean critical in the context of an attacker with limited resources. For a hardware wallet, a vulnerability that requires physical access and a custom jig to extract a seed is technically critical. In practice, it is not the kind of thing that gets you pulled off your chair. The team’s stated rate of one critical vulnerability per hour is impressive, but it also tells me they are scanning a sweeping range of projects. A broad scan will inevitably surface a lot of medium- and low-severity issues that get promoted to critical because the AI model was instructed to look for anything that could cause a loss of funds. That’s not a false positive. It’s a severity misclassification. And it wastes human time. Now, let’s talk about Coldcard and Boltz. Coldcard is a premium hardware wallet that has long advertised itself as an air-gapped, user-verified device. If its codebase is vulnerable, that’s a big deal. Boltz is a Lightning swap service that handles actual liquidity. If it has a vulnerability, that’s a big deal. The recent incidents involving these projects are separate from the volunteer team’s findings, but the proximity in time is not a coincidence. AI-assisted scanning is becoming common. It’s only a matter of time until someone uses these tools to find a vulnerability in a major service and exploits it before the maintainers can patch. The volunteer team is racing the clock, but they’re racing an invisible opponent. That is the essence of the security landscape now. I keep coming back to the same phrase: code is law, but logic is justice. In the Bitcoin world, we trust the code. But code does not enforce its own safety. The code we depend on is written by humans, reviewed by humans, and now attacked by machines. The asymmetry is fundamental. Machines can process thousands of lines per second. Humans and maintainers read at a few hundred words per minute. The AI-assisted defenders are the only reason we are not already seeing a flood of exploited vulnerabilities. But the number of human reviewers has not increased. The volunteer team that scanned 150 repositories is, by their own account, a small group. The maintainers who must fix their findings are even fewer. The imbalance is unsustainable. Let’s talk about what the next 12 months look like. I expect to see more of these volunteer AI security teams emerge. They will announce findings, submit reports, and some will generate public write-ups with technical details. The severity of their findings will be disputed. The maintainers will scramble to patch. Some patches will be rushed and will introduce new bugs. There is a real risk that the AI-driven security boom becomes a net negative for software quality, because it shifts the focus to finding bugs rather than fixing them correctly. This is a classic Goodhart’s law problem: when a metric becomes a target, it ceases to be useful. If the metric is “number of vulnerabilities found by AI,” the ecosystem will overproduce vulnerability reports. That will not make the ecosystem safer. It will make it more chaotic. The safer path is to build automated repair tools that can, at minimum, propose a patch and verify that the patch does not regress existing functionality. We are a long way from that. I also want to challenge one of the underlying assumptions in the announcement: that AI tools are equally useful for all types of code. Bitcoin-related projects are written in C++, Rust, Python, Go, JavaScript, and even hardware description languages. Some of these have better AI model coverage than others. C++ is well-represented in AI training data. Rust is less so. Bitcoin’s Lightning ecosystem has a significant Rust codebase, but post-quantum cryptography and taproot-related code are niche. The models that the team used — Kimi K3, GPT Sol, Claude Fable, Opus, GLM 5.2 — are all general-purpose models. They are not fine-tuned on BTC-specific attack patterns. That means they are likely better at finding generic memory safety issues than at finding Bitcoin-specific consensus bugs. The announcement does not clarify which languages or which types of vulnerabilities were found. That gap is significant. If the fourteen critical findings are concentrated in C++ memory management, that is less alarming to the broader Bitcoin ecosystem than if they touch the core transaction validation logic. I should also note that the threshold for what counts as a “critical” vulnerability is not standardized across projects. Some projects use a CVSS score. Others use their own risk matrix. The volunteer team’s claim of fourteen criticals is meaningless without an agreed-upon scale. I’ve seen projects label a denial-of-service that requires network access to a node as critical, while others would call it moderate. My own standard is CVE-2023-33201: a vulnerability that allows remote code execution without any special privilege. That’s critical. A vulnerability that requires physical access to a hardware wallet, or that requires a user to download a malicious payload — that is severe but not necessarily critical. Nothing in the announcement clarifies the severity scale used. I suspect the team is using a bucket like “affects user funds” or “can cause loss of funds,” which is broader than a technical exploitability assessment. That is not dishonest. It is just imprecise. Now, let’s take a step back and think about the philosophical implications this has for Bitcoin security. The Bitcoin network has survived for 15 years because its consensus rules are simple and battle-tested. But the infrastructure around it is not so simple. Wallets, exchanges, and Lightning services have increasingly complex codebases. Each new feature — taproot, ordinals, covenants — adds surface area. AI models do not get bored. They do not get tired. They can churn through a codebase until a vulnerability is found. This is great for security researchers. It is equally great for attackers. The difference is that attackers do not need to submit a report. They just need to exploit it once. One successful exploit is all it takes. Fourteen critical vulnerabilities, even if only one is exploitable and unpatched, represent fourteen chances for the ecosystem to have a bad day. The number that matters is not how many were found. It is how many have been patched before this article is published. I asked a few trusted maintainers in the Bitcoin space off-the-record about the impact of AI-assisted vulnerability hunting. Their response was consistent: it’s a double-edged sword that is currently falling on the same side — the side of the already overworked. One maintainer told me they now allocate 30% of their week solely to triaging automated vulnerability reports from various sources. That is time not spent writing features or improving the protocol. The volunteer team’s announcement is just the latest contribution to that burden. I don’t blame them. I blame the infrastructure surrounding open-source security: no standard for AI-generated report formats, no shared vulnerability database, no automated way to validate that an AI report is not a duplicate. The tools are being deployed before the plumbing is ready. What would a mature response look like? First, every project with crypto exposure should adopt a policy for AI-generated security reports. That policy should require a minimal proof-of-concept or a unit test that demonstrates the vulnerability. Second, the ecosystem should fund a neutral validation body that can independently replicate AI findings. This body would be staffed by senior auditors with deep protocol knowledge. Third, we need local, open-source AI models that can run on an air-gapped machine. This would eliminate the confidentiality leak of sending code to third-party APIs. None of these solutions are expensive relative to the potential cost of a $1 billion exploit. But they require coordination. Bitcoin’s chaos is both its strength and its weakness. In an emergency, we see a coordination problem. AI vulnerability hunting is not an emergency. It is the permanent new baseline. Once that baseline is accepted, adapting is just a matter of time. The most striking thing about the volunteer team’s announcement was the phrase “supporting documentation.” In traditional security research, the documentation is the deliverable. A vulnerability without documentation is unfinished. Here, the AI generated the documentation, and the human team presumably reviewed it. But did the humans verify every step of the exploit? Did they run the attack in a test environment? The announcement does not say. That silence is a lesson in itself. Security research has always been about trust and verification. AI makes the trust component even harder, because the machine produces natural language that feels like authoritative truth. My experience shows the code didn’t always cause what the report claimed. The code has always been the final authority, but AI now writes a plausible story about that code, and that story can be wrong. The only way to discover that wrongness is to manually reproduce the attack. If the volunteer team did that for fourteen critical vulnerabilities in twelve hours, they are either superhuman or sloppy. I lean toward the latter. But even with that skepticism, there is something genuinely thrilling about this development. For years, the bottleneck in security was the limited pool of talented auditors. AI has the potential to scale that pool. It lets a small team cover 150 repositories, which is something a single human could not do in the same time frame. It democratizes security research. The downside is that it also democratizes exploitation. The challenge is to tip the balance toward defense. The way to do that is not to hide from AI but to build better AI-ready pipelines for vulnerability triage and patch verification. The teams that do this will be the ones that survive the next bull market. The teams that ignore it will be the ones on the front page of a hindsight article about the $500 million hack that AI could have prevented. Let me close with a concrete prediction. Within six months, at least one well-known Bitcoin-related project will publicly disclose a critical vulnerability that was first found by an AI model. It might be one of the fourteen from this volunteer team, or it might be a separate finding from an attacker. The disclosure will be slow, because the project will need to organize a fix and coordinate with exchanges. There will be a list of affected versions, and users will be told to update. Some users will ignore the update. Others will not have a secure path to update their hardware wallet without physical access. That is the reality of modern crypto security: the hard part is never the discovery. It is the upgrade. The AI helped us find the bug in hours, but the human, social, and operational machinery to fix it will take days. That gap will be exploited. It always is. So when you read the next headline about AI finding thousands of bugs, ask not how many were found. Ask how many were fixed. That is the only number that changes the game.