AI Uncovers Critical Bitcoin Vulnerabilities as Security Teams Race Against Machine-Speed Attacks

Bitcoin Red Team Says AI Is Finding Critical Exploits Across Core Projects

Developers say the effort is uncovering critical vulnerabilities across wallets, cryptographic libraries, and infrastructure. A volunteer security initiative says it used frontier AI models to scan 150 Bitcoin repositories and found more than a dozen vulnerabilities as developers increasingly use artificial intelligence to audit blockchains. In a post on X earlier this week, AnchorWatch CEO Rob Hamilton said the group has spent about $20,000 on AI services while building a "Bitcoin red team" platform. "We have been working around the clock, with ~$20,000 of spend up to this point across different services," he wrote. "Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of." A red team refers to cybersecurity professionals who test software from an attacker's perspective, probing for vulnerabilities before they can be exploited. According to Hamilton, the Bitcoin red team uses Kimi K3 alongside OpenAI's GPT Sol, Anthropic's Claude Fable and Opus models, and Z.ai's GLM 5.2 to identify vulnerabilities and generate supporting documentation. "We also have been connected with OpenAI for some help so I could manage getting the Cyber Harness running as well," he wrote. "It's a much more expensive scan, but well worth it for load-bearing portions of the Bitcoin ecosystem and has already yielded good results." Pseudonymous Bitcoin developer Calle said the initiative has built multiple AI-powered review systems targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. "We're averaging on the order of one critical exploit per hour per person," Calle wrote on X. "We've reported critical vulnerabilities to several projects in the last 12 hours. Thankfully, this is a very expensive exercise. We're burning through $10,000 per day." The team did not disclose which projects were affected or provide details of the vulnerabilities. The announcement comes as AI is playing a growing role in finding security flaws across the crypto industry. Earlier this year, researchers using Anthropic's Claude Opus 4.8 uncovered a four-year-old flaw in Zcash that could have allowed attackers to create unlimited counterfeit ZEC. In August, Coinkite said it believes attackers used AI to identify the Coldcard wallet vulnerability, while Bitcoin bridge Boltz suspended its swap service after saying attackers were using AI to identify vulnerabilities faster than its team could patch them.

Ledger Says Coldcard Exploit Shows Bitcoin Wallet Security Must Adapt to AI

Ledger says AI is accelerating vulnerability discovery and forcing security teams to defend at machine speed. Hardware wallet maker Ledger says the recent Coldcard exploit should serve as a warning for the cryptocurrency industry. According to Ledger CTO Charles Guillemet, the incident exposed weaknesses in how some devices, in this case hardware cryptocurrency wallets, generate cryptographic randomness while showing how artificial intelligence is reshaping both cyberattacks and digital defenses. "We're treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness," Guillemet told Decrypt. "Cryptography is hard and implementing it securely is harder. This week's Coldcard incident made that visible in the most expensive way possible." The comments come as the fallout from the Coldcard exploit continues to grow. Last week, Coldcard maker Coinkite disclosed a flaw in the air-gapped Coldcard Bitcoin hardware wallet that traces back to a March 2021 firmware build. The bug used a software fallback instead of the device's hardware random number generator to create wallet recovery seeds, making some private keys guessable and allowing thieves to steal user Bitcoin. To date, losses have reached roughly $130 million while other thefts remain under investigation. On Sunday, Coinkite released patched firmware and urged affected users to move funds to newly generated wallets. Coinkite did not respond to Decrypt's request for comment for this story. Ledger said its own hardware wallets were not affected because they generate recovery phrases differently. "Ledger hardware wallets draw their root secret (the 24-word Secret Recovery Phrase) from a true hardware random number generator built directly into a certified Secure Element, with no software fallback path," Guillemet said. "That generator produces the full 256 bits of entropy for every seed." For Ledger, the incident raises broader questions about how hardware wallet security is evaluated. "Open source and reviewed are not the same thing," Guillemet said. "This flaw sat in public code for more than five years until, reportedly, an adversary used AI to find it, a reminder that being open and being reviewed are two different things." He said AI is changing cybersecurity by allowing attackers to scan code, search for configuration errors, and identify vulnerabilities "at machine speed." "That means defense has to move at the same speed," he said. "It needs to come from security by design, hardware, and math." In May, a security researcher using Claude Opus 4.8 discovered a four-year-old vulnerability that could have fueled unlimited minting of Zcash, leading to large-scale investor panic and sending Zcash down more than 40% in a single day in response. According to Guillemet, Ledger says it has spent the past two years using AI alongside human security engineers and cryptographers to review code and identify vulnerabilities before attackers can exploit them. "We also don't just rely on our own word for it," he explained. "Our Donjon research lab exists to try to break our products before anyone else can." To mitigate future risk, Guillemet said users evaluating any hardware wallet should understand how it generates randomness and whether that process has been independently certified. "Randomness has to come from physics, not a formula," he said. "It has to be certified by people whose job is trying to break that claim, not just asserted by the vendor."

How AI Test Rediscovered a Bitcoin Bug that Could Have Led to Theft

The findings also highlight a shift in how may evolve. Much of the industry's long-term focus has been on quantum computing, which could eventually threaten Bitcoin's cryptographic foundations. AI presents a more immediate challenge because it can already identify mistakes in wallet firmware, random-number generation, key management, and cryptographic implementations without breaking Bitcoin's underlying encryption. According to Qureshi, the affected users were "People who are doing all the right things." Even users storing assets in offline hardware wallets remain dependent on the quality of the wallet's firmware and cryptographic implementation. If private keys are generated using weak randomness, keeping a device offline cannot strengthen those keys afterward. For developers, represents both a defensive and offensive tool. Wallet manufacturers can repeatedly scan legacy firmware as newer AI models become available, while attackers can automate vulnerability discovery across older software releases at minimal cost. The experiment underscores an important lesson for the cryptocurrency industry: security reviews can no longer be treated as one-time events. As AI models become faster, cheaper, and more capable, continuous code auditing, responsible disclosure programs, and rapid patch deployment will become essential for protecting digital assets.