Bitcoin Contributor Fixes Wallet Crash Bug With AI Tools, Exposing Both Promise and Friction in AI-Powered Security
Key Takeaways
- •Rob Hamilton's first Bitcoin Core commit, merged on August 20, fixed a wallet-related bug discovered through AI-assisted code analysis.
- •The Bitcoin Red Team, comprising Hamilton and 16 volunteers, documented 4,962 findings across more than 390 repositories in about 30 hours, including 85 critical and 635 high-severity issues.
- •A July Coldcard hardware wallet vulnerability that resulted in the theft of more than 1,000 BTC prompted Hamilton to expand his solo AI experiments into a coordinated campaign.
- •OpenAI blocked Hamilton from conducting Bitcoin security analysis with its tools around August 9, and the team switched to alternative AI systems such as Kimi K3.
- •Hamilton acknowledged that coordinating triage and patching with volunteer maintainers across hundreds of repositories is a far greater challenge than generating AI-discovered findings.
Rob Hamilton, CEO of AnchorWatch and a Bitcoin contributor, had his first commit merged into Bitcoin Core on August 20. The fix addressed a wallet-related bug, and the notable part is how he discovered it: by pointing AI models at Bitcoin's codebase and letting them hunt for problems.
Hamilton's effort is part of a broader initiative he calls the "Bitcoin Red Team," a volunteer-driven campaign that uses AI to systematically audit Bitcoin-related open-source code. The project has already surfaced thousands of potential issues, including dozens classified as critical. It also revealed something uncomfortable about the current state of AI-powered security research: the tools you need can be yanked away mid-audit.
The result carries weight beyond one patch. Bitcoin Core is the reference implementation of the Bitcoin protocol, and changes to it undergo extensive review from a small group of volunteer maintainers before being merged — a process built for caution, given that the software secures hundreds of billions of dollars in value.
Inside the Bitcoin Red Team's 30-Hour Sprint
The Red Team consists of Hamilton and 16 volunteers, who launched their first major push in early August. In roughly 30 hours, the group documented 4,962 findings across more than 390 Bitcoin-related open-source repositories. Of those, 85 were flagged as critical and 635 as high-severity.
Hamilton had been experimenting with AI-assisted code analysis on Bitcoin Core as early as May. The catalyst that turned a solo experiment into a coordinated campaign was a Coldcard hardware wallet vulnerability in July that led to the theft of over 1,000 BTC.
OpenAI Pulls the Plug, Alternatives Step In
Around August 9, OpenAI blocked Hamilton from conducting further Bitcoin security analysis using its tools. The group pivoted to alternative AI systems, including Kimi K3, to continue their work.
The episode also illustrates how dependent independent security researchers can be on a handful of AI providers, and how quickly access terms can change for work that is defensive in nature.
The Bottleneck Isn't Finding Bugs Anymore
Hamilton himself acknowledged a significant limitation of the AI-first approach: downstream coordination with maintainers. Finding nearly 5,000 issues in 30 hours is impressive. Getting maintainers of hundreds of different repositories to review, triage, and patch those findings is an entirely different challenge.
The ratio tells the story: nearly 5,000 findings in 30 hours of scanning, versus one merged commit after weeks of review. For Bitcoin Core in particular, where maintainers typically review contributions on a volunteer basis alongside other commitments, a surge of machine-generated findings could test how the project's existing review culture absorbs a much larger volume of reports — and whether disclosure of AI-assisted findings, as Hamilton followed in reporting the wallet bug through proper channels, becomes a norm for similar efforts.
