The Bitcoin Red Team has scanned 501 open-source Bitcoin projects and produced 7,958 security findings, including 1,280 rated high or critical severity, as AI dramatically accelerates code review across wallets, Lightning software and Bitcoin infrastructure.
Twenty-five developers worked on the coordinated review for 108 hours, combining human analysis with automated harnesses and AI models. The project has relied heavily on Moonshot AI’s Kimi K3 alongside other models, with OpenSats funding the compute costs through its dedicated Bitcoin Red Team programme.
The 7,958 entries should not be treated as 7,958 independently confirmed vulnerabilities. Maintainers and researchers must reproduce AI-generated findings, determine whether an exploitable path exists and assess the actual severity before patches are released.
Maintainers Validate Critical Findings
Bitcoin developer Calle said project maintainers have validated numerous critical and high-severity reports produced during the review. The campaign grew from 4,962 findings across 390 projects on August 5 to nearly 8,000 across 501 repositories within days.
The work accelerated after Coldcard-linked Bitcoin thefts expanded beyond $130 million, exposing how a weakness buried in open-source firmware could remain unnoticed for years before attackers began exploiting vulnerable wallet seeds.
Calle said unmaintained repositories present a particular problem because AI can identify exploitable weaknesses without an active development team available to investigate or patch them. The same economics apply beyond Bitcoin, a risk already raised when Coinbase CEO Brian Armstrong argued that AI would make software security stronger while simultaneously lowering the cost of finding vulnerabilities.
BTCPay Server Patches Exploited Lightning Flaw
The review has already intersected with a live security failure. BTCPay Server patched a critical vulnerability in version 2.4.2 that allowed an unauthenticated remote attacker to obtain LND admin macaroon credentials and potentially control connected Lightning wallets.
Attackers exploited the flaw before the patch and stole funds from affected users. BTCPay later committed 0.21 BTC to Craig Raw and another 0.21 BTC to the Bitcoin Red Team for responsible disclosure and analysis, while introducing stronger code-scanning and security-review procedures.
Users running BTCPay Server with LND on any version before 2.4.2 were told to update immediately and rotate affected credentials.
Coinbase And BitGo Join Call For Frontier AI Access
More than 40 Bitcoin and digital-asset organizations have signed the “Defenders Need the Frontier” open letter, asking major AI laboratories to give qualified open-source security researchers controlled access to their strongest cybersecurity models.
Signatories include Coinbase, Block, BitGo, Strategy, MARA, Galaxy, Trezor, Blockstream, Anchorage Digital, Brink, Chaincode Labs and OpenSats. The coalition is seeking early model access, sufficient compute, secure research environments and direct disclosure channels with AI-lab security teams.
OpenSats now operates a dedicated fund reimbursing AI compute costs and paying researchers who responsibly disclose flaws in critical Bitcoin software, while BTCPay Server 2.4.2 remains the required fixed release for the exploited LND credential vulnerability.
