The Bitcoin Red Team, led by Calle, is leveraging Chinese AI models to identify security vulnerabilities in the Bitcoin open-source ecosystem. Combining AI tools with human review, the volunteer group is scrutinizing wallets, Lightning applications, software libraries, and other projects to uncover flaws. By privately reporting credible findings to developers, they aim to address the vulnerabilities before they are made public.
Calle highlighted the significance of the endeavor, stating, "We're experiencing a massive collision between decades of human open source slop against 2 weeks of Kimi K3." Kimi K3, an AI model from Chinese startup Moonshot AI, offers developers the capability to analyze extensive codebases and perform complex software tasks with minimal oversight. Additionally, the team has utilized Z.ai's GLM 5.2 and models from OpenAI and Anthropic, noting challenges with American models due to imposed restrictions on security research.
The Bitcoin Red Team's efforts have yielded substantial results, with over 4,900 findings across 390 projects reported in August. Among these, 85 were classified as critical and 635 as high severity. While the affected projects have not been disclosed, developers have confirmed the presence of significant vulnerabilities. Calle emphasized the importance of prompt action by stating, "Response speed is very different across projects and shows how healthy each project is." Lightning software, crucial for expediting Bitcoin transactions, posed particular challenges during the review process due to its complexity.
Highlighting the importance of AI audits, Calle stressed the necessity for projects to establish their AI audit pipelines for enhanced security measures. The developer cautioned against relying on unmaintained projects and noted the increased pressure on developers to ensure software security. Despite the arduous nature of the audits, Calle expressed optimism about the strengthened resilience of Bitcoin's software, stating, "Bitcoin is the obvious first target, but the rest of the world will follow shortly." The audits, though demanding, are viewed as essential for fostering a more secure digital environment.
In a parallel development, Hugging Face recently employed China's GLM 5.2 for investigating a breach following a cyber intrusion. The utilization of Chinese AI models underscores the growing reliance on advanced technologies for bolstering cybersecurity measures. As the scrutiny intensifies within the cryptocurrency realm, the integration of AI tools is becoming increasingly indispensable for safeguarding digital assets and infrastructure.