Bitcoin Red Team Says AI Is Finding Critical Exploits Across Core Projects

A volunteer security initiative says it used frontier AI models to scan 150 Bitcoin repositories and found more than a dozen vulnerabilities as developers increasingly use artificial intelligence to audit blockchains.

In a post on X earlier this week, AnchorWatch CEO Rob Hamilton said the group has spent about $20,000 on AI services while building a “Bitcoin red team” platform.

“We have been working around the clock, with ~$20,000 of spend up to this point across different services,” he wrote. “Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of.”

A red team refers to cybersecurity professionals who test software from an attacker’s perspective, probing for vulnerabilities before they can be exploited.

According to Hamilton, the Bitcoin red team uses Kimi K3 alongside OpenAI’s GPT Sol, Anthropic’s Claude Fable and Opus models, and Z.ai’s GLM 5.2 to identify vulnerabilities and generate supporting documentation.

“We also have been connected with OpenAI for some help so I could manage getting the Cyber Harness running as well,” he wrote. “It’s a much more expensive scan, but well worth it for load-bearing portions of the Bitcoin ecosystem and has already yielded good results.”

Pseudonymous Bitcoin developer Calle said the initiative has built multiple AI-powered review systems targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects.

“We’re averaging on the order of one critical exploit per hour per person,” Calle wrote on X. “We’ve reported critical vulnerabilities to several projects in the last 12 hours. Thankfully, this is a very expensive exercise. We’re burning through $10,000 per day.”

The team did not disclose which projects were affected or provide details of the vulnerabilities.

The announcement comes as AI is playing a growing role in finding security flaws across the crypto industry. Earlier this year, researchers using Anthropic’s Claude Opus 4.8 uncovered a four-year-old flaw in Zcash that could have allowed attackers to create unlimited counterfeit ZEC. In August, Coinkite said it believes attackers used AI to identify the Coldcard wallet vulnerability, while Bitcoin bridge Boltz suspended its swap service after saying attackers were using AI to identify vulnerabilities faster than its team could patch them.