Highlights

Volunteers on the Bitcoin Red Team are leveraging powerful Chinese AI models to scan a broad range of Bitcoin open-source projects, finding numerous critical and high-severity vulnerabilities. The group combines automated analysis with human review and privately reports credible issues to maintainers. This surge in automated auditing has revealed many previously overlooked vulnerabilities and increased pressure on unmaintained projects. The team urges projects to adopt regular AI-assisted audits and address findings quickly to improve overall ecosystem security.

Sentiment Analysis

• The overall tone of the article is mixed-to-urgent: it recognizes progress in identifying vulnerabilities while emphasizing significant risk across many projects. The narrative balances alarm about widespread issues with a constructive view that audits strengthen Bitcoin over time.
• The article highlights frustration with limits imposed by some Western AI providers, leading researchers to adopt Chinese models for deeper, less restricted analysis.
• There is also a forward-looking recommendation: projects that acted early by integrating AI audits are in better shape than those that did not, implying a clear path to mitigation.
• Visual sentiment representation:

Article Text

The Bitcoin Red Team, a volunteer group focused on strengthening Bitcoin-related software, has turned to Chinese AI models to search widely for security flaws across the open-source ecosystem. By combining automated model analysis with manual review, the group inspects wallets, Lightning implementations, libraries, and other projects that support Bitcoin’s infrastructure. Their approach is designed to identify vulnerabilities that might otherwise remain hidden in large, mature codebases.

According to the team’s lead, known pseudonymously as Calle, the effort has been extensive: they report scanning nearly the entire Bitcoin open-source landscape and filing thousands of findings with maintainers. These submissions include a substantial number of high-severity and critical issues, which the team says have been confirmed by developers. The Red Team operates by privately disclosing credible problems so maintainers can remediate them before any technical details become public.

The choice to use Chinese AI models arose in part because some Western commercial providers place restrictions that complicate security research. Models developed by Chinese organizations—such as Kimi K3 from Moonshot AI and GLM 5.2 from Z.ai—have been used for deep code analysis and long-form software tasks with less operational friction for researchers. Calle described this as a rapid collision of decades of accumulated open-source technical debt with recent AI capabilities, observing that many projects show vulnerabilities once scanned at scale. This intensified scrutiny has exposed numerous issues, especially in complex subsystems like Lightning implementations.

Despite the alarming discoveries, the Red Team frames the work as ultimately beneficial. By finding and responsibly disclosing problems, they aim to make Bitcoin software more robust. The group’s reporting shows significant variation in how quickly maintainers respond, a metric Calle notes reflects each project’s health. Projects that had already started AI-driven audits earlier are reportedly in a much better position to address findings than those that have not. As a result, the Red Team recommends that projects develop their own AI audit pipelines and incorporate them into regular security practices.

The scale of findings shared by the team is substantial: in a recent filing, thousands of issues across hundreds of projects were documented, with several dozen rated critical and many more marked high severity. While the Red Team has not publicly named specific vulnerable projects or released detailed technical write-ups, the volume and severity of reported flaws underscore a systemic risk posed by neglected or lightly maintained code. The team’s disclosures are intended to prompt swift fixes rather than public alarm.

Lightning software, which enables faster and lower-cost Bitcoin payments, attracted particular attention. Its complexity made audits more challenging and led Calle to describe it as more problematic than average. This illustrates how specialized, high-value components of the ecosystem may carry outsized risk when not actively maintained and reviewed. The Red Team’s work highlights the need for ongoing, automated, and human-supervised review processes across all critical projects.

There are broader implications beyond Bitcoin. Other organizations have similarly turned to diverse AI models for incident investigation and forensic tasks when commercial systems proved limiting. The trend suggests that security researchers will increasingly adopt varied model sources to bypass operational constraints and perform exhaustive analyses.

Ultimately, while the Red Team’s message that parts of Bitcoin are "burning" reflects the urgency of the discovered issues, the group emphasizes that these audits lead to stronger software. They suggest that occasional, rigorous purges of vulnerabilities—accelerated by AI—can create a healthier foundation for future development. The immediate takeaway for maintainers and contributors is clear: prioritize remediation, adopt AI-assisted audits, and treat unmaintained projects with caution to preserve the integrity of the broader Bitcoin ecosystem.

Key Insights Table