Bitcoin Contributor Utilizes AI Tools to Identify Wallet Bug

Rob Hamilton, CEO of AnchorWatch, achieved his first commit to Bitcoin Core on August 20. The contribution addressed a bug identified through the use of AI models tasked with auditing the Bitcoin codebase.

This work is part of the Bitcoin Red Team, a volunteer initiative led by Hamilton that employs AI to audit open-source code related to Bitcoin. The project aims to systematically identify security issues, though Hamilton noted that the volume of findings creates challenges for maintainers tasked with reviewing and patching the code.

During a 30-hour sprint in early August, Hamilton and 16 volunteers documented 4,962 findings across 390 repositories. Of these, 85 were categorized as critical and 635 as high-severity. The initiative was prompted by a July vulnerability in a Coldcard hardware wallet that resulted in the theft of over 1,000 BTC.

The project encountered operational hurdles when OpenAI blocked Hamilton from using its tools for Bitcoin security analysis around August 9. The team subsequently transitioned to alternative systems, such as Kimi K3, to continue their research.

Hamilton highlighted a disparity between the speed of AI-assisted discovery and the pace of manual remediation. While the team generated nearly 5,000 findings in 30 hours, the process of coordinating with maintainers to review and address these issues remains a significant bottleneck.