AI Security Tools Uncover Over 1,200 Critical Bitcoin Vulnerabilities in Days

Bitcoin Red Team Says AI Is Finding Critical Exploits Across Core Projects

Developers say the effort is uncovering critical vulnerabilities across wallets, cryptographic libraries, and infrastructure. A volunteer security initiative says it used frontier AI models to scan 150 Bitcoin repositories and found more than a dozen vulnerabilities as developers increasingly use artificial intelligence to audit blockchains. In a post on X earlier this week, AnchorWatch CEO Rob Hamilton said the group has spent about $20,000 on AI services while building a "Bitcoin red team" platform. "We have been working around the clock, with ~$20,000 of spend up to this point across different services," he wrote. "Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of." A red team refers to cybersecurity professionals who test software from an attacker's perspective, probing for vulnerabilities before they can be exploited. According to Hamilton, the Bitcoin red team uses Kimi K3 alongside OpenAI's GPT Sol, Anthropic's Claude Fable and Opus models, and Z.ai's GLM 5.2 to identify vulnerabilities and generate supporting documentation. "We also have been connected with OpenAI for some help so I could manage getting the Cyber Harness running as well," he wrote. "It's a much more expensive scan, but well worth it for load-bearing portions of the Bitcoin ecosystem and has already yielded good results." Pseudonymous Bitcoin developer Calle said the initiative has built multiple AI-powered review systems targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. "We're averaging on the order of one critical exploit per hour per person," Calle wrote on X. "We've reported critical vulnerabilities to several projects in the last 12 hours. Thankfully, this is a very expensive exercise. We're burning through $10,000 per day." The team did not disclose which projects were affected or provide details of the vulnerabilities. The announcement comes as AI is playing a growing role in finding security flaws across the crypto industry. Earlier this year, researchers using Anthropic's Claude Opus 4.8 uncovered a four-year-old flaw in Zcash that could have allowed attackers to create unlimited counterfeit ZEC. In August, Coinkite said it believes attackers used AI to identify the Coldcard wallet vulnerability, while Bitcoin bridge Boltz suspended its swap service after saying attackers were using AI to identify vulnerabilities faster than its team could patch them.

Ledger Says Coldcard Exploit Shows Bitcoin Wallet Security Must Adapt to AI

Ledger says AI is accelerating vulnerability discovery and forcing security teams to defend at machine speed. Hardware wallet maker Ledger says the recent Coldcard exploit should serve as a warning for the cryptocurrency industry. According to Ledger CTO Charles Guillemet, the incident exposed weaknesses in how some devices, in this case hardware cryptocurrency wallets, generate cryptographic randomness while showing how artificial intelligence is reshaping both cyberattacks and digital defenses. "We're treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness," Guillemet told Decrypt. "Cryptography is hard and implementing it securely is harder. This week's Coldcard incident made that visible in the most expensive way possible." The comments come as the fallout from the Coldcard exploit continues to grow. Last week, Coldcard maker Coinkite disclosed a flaw in the air-gapped Coldcard Bitcoin hardware wallet that traces back to a March 2021 firmware build. The bug used a software fallback instead of the device's hardware random number generator to create wallet recovery seeds, making some private keys guessable and allowing thieves to steal user Bitcoin. To date, losses have reached roughly $130 million while other thefts remain under investigation. On Sunday, Coinkite released patched firmware and urged affected users to move funds to newly generated wallets. Coinkite did not respond to Decrypt's request for comment for this story. Ledger said its own hardware wallets were not affected because they generate recovery phrases differently. "Ledger hardware wallets draw their root secret (the 24-word Secret Recovery Phrase) from a true hardware random number generator built directly into a certified Secure Element, with no software fallback path," Guillemet said. "That generator produces the full 256 bits of entropy for every seed." For Ledger, the incident raises broader questions about how hardware wallet security is evaluated. "Open source and reviewed are not the same thing," Guillemet said. "This flaw sat in public code for more than five years until, reportedly, an adversary used AI to find it, a reminder that being open and being reviewed are two different things." He said AI is changing cybersecurity by allowing attackers to scan code, search for configuration errors, and identify vulnerabilities "at machine speed." "That means defense has to move at the same speed," he said. "It needs to come from security by design, hardware, and math." In May, a security researcher using Claude Opus 4.8 discovered a four-year-old vulnerability that could have fueled unlimited minting of Zcash, leading to large-scale investor panic and sending Zcash down more than 40% in a single day in response. According to Guillemet, Ledger says it has spent the past two years using AI alongside human security engineers and cryptographers to review code and identify vulnerabilities before attackers can exploit them. "We also don't just rely on our own word for it," he explained. "Our Donjon research lab exists to try to break our products before anyone else can." To mitigate future risk, Guillemet said users evaluating any hardware wallet should understand how it generates randomness and whether that process has been independently certified. "Randomness has to come from physics, not a formula," he said. "It has to be certified by people whose job is trying to break that claim, not just asserted by the vendor."

Crypto Companies Urge AI Firms to Give Bitcoin Devs Early Access

The Bitcoin Policy Institute and other industry participants urged AI companies to offer early access to their frontier models to aid Bitcoin and open-source developers in their cybersecurity efforts. A group of cryptocurrency companies has urged frontier artificial intelligence (AI) labs to give Bitcoin developers early access to their most capable models. The letter, published by the Bitcoin Policy Institute (BPI) on Monday, said many digital asset defenders, including Bitcoin Core developers, lack access to lab cyber programs and can be blocked by guardrails on publicly available frontier systems, leaving them to rely on less capable open-weight models. The signatories urged frontier AI labs to "establish or expand standing trusted-access programs for qualified defenders of open-source financial infrastructure." The letter said open-source software supports critical digital and financial infrastructure, while Bitcoin (BTC) alone secures more than $1 trillion in value. It added that a vulnerability in open-source infrastructure can place life savings at risk. The open letter was co-signed by multiple crypto companies and organizations, including the African Bitcoin Institute, Anchorage Digital, BitGo, Bitwise, Blockstream, Bull Bitcoin, MARA, Kraken, Ledger and Trezor, among others. Open-source defenders need access to frontier AI The letter said frontier AI is changing the economics of security research and cyber operations because advanced models can search large codebases, identify potential weaknesses and accelerate complex technical work for both defenders and adversaries. It said frontier AI could become one of the "most powerful defensive technologies ever developed," adding: "Without dedicated access programs, defenders may lack the tools needed to keep pace with evolving threats to the infrastructure they maintain." The BPI said it received multiple independent reports from open-source maintainers describing sophisticated actors, including potential foreign adversaries, using advanced AI capabilities to sustain attacks. Total crypto hacks by monthly sum, all-time chart. Source: DefiLlama Hacking activity across the industry surged in April 2026, as malicious actors stole over $634 million from cryptocurrency platforms, the highest monthly total since the Bybit hack, which helped drive losses to roughly $1.4 billion in February 2025, according to DefiLlama data. Advances in AI-assisted vulnerability discovery have raised concerns across the crypto security industry. New models such as Claude Opus 4.8 and ChatGPT 5.5 have contributed to what Mitchell Amador, CEO of bug bounty platform Immunefi, described as a "vulnerability apocalypse" for the crypto industry.

Bitcoin Researcher Turns to Chinese AI after OpenAI Restricts Access

Bitcoin Red Team has now found 1,288 critical and high-level vulnerabilities in the Bitcoin ecosystem as of Saturday. A Bitcoin security researcher says he has been forced to go back to using open-source Chinese AI models after finding himself restricted from analyzing further codebases by OpenAI, highlighting a growing concern that the most capable AI tools aren't being made available to defenders. In an X post on Tuesday, AnchorWatch CEO Rob Hamilton said he had begun integrating OpenAI's Trust & Cyber capabilities into his Bitcoin Red Team work on Saturday, only to find his access restricted the following morning. "It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to conduct my research to protect Bitcoin infrastructure," he added. Bitcoin Red Team, a group of volunteers, has been using AI tools and human review to scan hundreds of open-source Bitcoin-related repositories for vulnerabilities, with efforts accelerating days after the Coldcard hardware wallet hack, which has seen over $100 million in Bitcoin stolen. Last month, crypto executives told Cointelegraph that many of crypto's biggest players are still waiting to gain access to powerful new AI models to strengthen their code from attacks, with only a select few having been able to get it. "I am now prevented from being able to continue the investigation in a further effort to make sure their code changes are sufficient, as well as understand if there are other issues that have yet to be discovered," said Hamilton. "Black hats will not hit these issues. The white hats will. We've hit a local minima in policy," said Hamilton. "Intelligence is unrestricted for those who don't follow rules, and those who engage in harm reduction are left on the sidelines."

How AI Test Rediscovered a Bitcoin Bug that Could Have Led to Theft

The findings also highlight a shift in how may evolve. Much of the industry's long-term focus has been on quantum computing, which could eventually threaten Bitcoin's cryptographic foundations. AI presents a more immediate challenge because it can already identify mistakes in wallet firmware, random-number generation, key management, and cryptographic implementations without breaking Bitcoin's underlying encryption. According to Qureshi, the affected users were "People who are doing all the right things." Even users storing assets in offline hardware wallets remain dependent on the quality of the wallet's firmware and cryptographic implementation. If private keys are generated using weak randomness, keeping a device offline cannot strengthen those keys afterward. For developers, represents both a defensive and offensive tool. Wallet manufacturers can repeatedly scan legacy firmware as newer AI models become available, while attackers can automate vulnerability discovery across older software releases at minimal cost. The experiment underscores an important lesson for the cryptocurrency industry: security reviews can no longer be treated as one-time events. As AI models become faster, cheaper, and more capable, continuous code auditing, responsible disclosure programs, and rapid patch deployment will become essential for protecting digital assets.