Bitcoin contributor fixes wallet crash bug using AI tools, exposing both promise and friction in AI-powered security

Rob Hamilton, CEO of AnchorWatch and a Bitcoin contributor, got his first commit merged into Bitcoin Core on August 20. The fix addressed a wallet-related bug, and the interesting part is how he found it: by pointing AI models at Bitcoin’s codebase and letting them hunt for problems.

Hamilton’s effort is part of a broader initiative he calls the “Bitcoin Red Team,” a volunteer-driven campaign that uses AI to systematically audit Bitcoin-related open-source code. The project has already surfaced thousands of potential issues, including dozens classified as critical. It also revealed something uncomfortable about the current state of AI-powered security research: the tools you need can be yanked away mid-audit.

Inside the Bitcoin Red Team’s 30-hour sprint

The Red Team consists of Hamilton and 16 volunteers who launched their first major push in early August. In roughly 30 hours, the group documented 4,962 findings across more than 390 Bitcoin-related open-source repositories. Of those, 85 were flagged as critical and 635 as high-severity.

Hamilton had been experimenting with AI-assisted code analysis on Bitcoin Core as early as May. The catalyst that turned a solo experiment into a coordinated campaign was a Coldcard hardware wallet vulnerability in July that led to the theft of over 1,000 BTC.

OpenAI pulls the plug, alternatives step in

Around August 9, OpenAI blocked Hamilton from conducting further Bitcoin security analysis using its tools. The group pivoted to alternative AI systems, including Kimi K3, to continue their work.

The bottleneck isn’t finding bugs anymore

Hamilton himself acknowledged a significant limitation of the AI-first approach: the downstream coordination with maintainers. Finding nearly 5,000 issues in 30 hours is impressive. Getting maintainers of hundreds of different repositories to review, triage, and patch those findings is an entirely different challenge.

The ratio tells the story. Nearly 5,000 findings in 30 hours of scanning, versus one merged commit after weeks of review.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.