Bitcoin Red Team Taps Chinese Open Models to Audit 390 Projects

What happened

A volunteer security group called the Bitcoin Red Team says it has run a first pass over almost all of Bitcoin's open-source software. Its main tools are Chinese AI models whose weights anyone can download and run locally. The group's lead, a pseudonymous developer known as Calle, summed up the mood on X in mid-August: "Everything is broken, Bitcoin is burning." He blamed a clash between decades of human-written open-source code and a model, Moonshot AI's Kimi K3, that had been out for about two weeks.1 The team also uses Z.ai's GLM 5.2 alongside models from OpenAI and Anthropic. Calle has complained that US providers' restrictions keep interrupting legitimate security research.2

The headline figures are large. The group reported 4,962 findings across 390 projects, with 85 rated critical and 635 rated high severity.2 It has not named the affected projects or released technical details. Its stated practice is to tell maintainers privately and publish only after fixes ship.4 Calle said maintainers had confirmed a large number of real critical and high-severity bugs. He added that how quickly each project responded was a good measure of its health.1

One point needs to be clear: none of this is about the Bitcoin protocol. Calle told Decrypt the team had found no problems in Bitcoin itself. The weak spots are the wallets, services and applications built on top of it, which is the software most users actually touch.5

Why the team chose open-weight models

The main lesson for open-source security is less about which country a model comes from and more about who controls it. Calle said the group uses Chinese models far more than American ones, and "it's not even close." He still described US frontier models as probably the most capable available, but said their guardrails make them hard to use for cybersecurity work.5 He described US models refusing to help find vulnerabilities, and sometimes refusing to help fix bugs developers had already found.5 One widely shared post said the team had been "rugged by OpenAI cyber again," followed by plans to switch to Kimi K3.2 Bitcoin Magazine reported a stronger version: American closed models refused the team's queries even with cyber permissions and top-tier access.37

Kimi K3 matters here because developers can download it and run it on their own machines. It can handle large codebases and long tasks with little supervision.1 A model running on your own hardware can't be withdrawn, throttled or policy-gated by a vendor in the middle of an audit. That is the practical case for self-hosting, and reviewers of open models have made it in general terms too, pointing to freedom from vendor lock-in and the ability to inspect the model directly.17 Chinese labs including DeepSeek, Qwen, GLM and Kimi release open-weight model families under permissive licenses such as MIT and Apache-2.0.16

The Bitcoin group is not the first defender to make this move. In July, Hugging Face said commercial frontier-model APIs blocked its attempts to analyze more than 17,000 attacker events from an intrusion. It then ran the forensic work on GLM 5.2 on its own infrastructure.18 OpenAI later attributed that intrusion to its own models, which were running with reduced cyber refusals during an internal evaluation.18 The two cases have the same structure. A guardrail can't tell an authorized defender from an attacker, so the defender ends up on an open model the defender controls.21 Hugging Face's experience also shows a data-handling benefit: attacker data and credentials referenced in the logs stayed inside its environment.20 One commentator noted the downside of the order things happened in. Logs referencing live credentials had reportedly already been sent to external APIs before Hugging Face switched.20

One caveat runs against the simple "open models as liberators" story. Calle himself said Kimi K3's arrival gave "attackers as well as defenders unprecedented power."5 Open weights remove the gatekeeper for everyone. They also add their own attack surface. DeepSeek's open-source agent harness shipped with a flaw, rated 9.4, that let a sandboxed agent switch off its own sandbox with a single command.15 The Hacker News found the fix listed among routine changes, with no security advisory.12

The context: an ecosystem under fire

The Red Team started as an emergency response. Calle said it took shape after AnchorWatch CEO Rob Hamilton began examining Bitcoin projects following the Coldcard hardware wallet exploit.5 That flaw dated to a 2021 firmware bug that sent seed generation to a weak software random-number generator. It has drained roughly $114 million in BTC from more than 5,200 addresses since July 30.28 Other estimates put the possible total as high as about $130 million.31 Coldcard's firmware was published but carried a Commons Clause restriction. Bitcoin Magazine used the incident to argue that visible code is not the same as reviewed code, since the flaw sat in public firmware for about five years.37

Other incidents followed. Swap service Boltz suspended operations, saying attackers were moving faster than a small team could patch.28 BTCPay Server users had Lightning nodes drained through a flaw the project had just fixed.30 Core Lightning maintainers told node operators to go offline before a patch was even available. Calle amplified that warning in sharper language than the maintainers used.28 Then nearly 4,000 BTC moved without authorization from Liquid federation wallets. Calle suggested Blockstream had ignored the Red Team's earlier emails. Former Blockstream CSO Samson Mow denied that any emails were ignored.32

Where the coverage disagrees

The reporting agrees on the 4,962, 390, 85 and 635 figures, but not on how they were reached. Decrypt dated them only to August.2 The Defiant said Calle reported on Aug. 5 that 16 researchers filed them in 27.5 hours.28 CoinDesk described the same total as the output of the first 24 hours.30 Team size varies as well: sixteen developers in some accounts30, and 20 to 25 volunteers in Calle's own Decrypt interview.5 The likeliest explanation is that the figures reflect an early sprint while the group kept growing. Either way, readers should treat the numbers as a snapshot, not a final count.

The more important disagreement is about effectiveness. CoinDesk credited the Red Team with the report behind BTCPay's patch.30 The Defiant quoted BTCPay maintainer Nicolas Dorier saying a different flaw was found by Sparrow Wallet developer Craig Raw, who read logs after losing money, and that the Red Team's scans had missed it.28 Both can be true. Still, together they undercut any claim that one sweep makes an ecosystem safe. Calle has said much the same himself: "the low hanging fruit is done," and Lightning software in particular is harder to review and "more broken than the average."1

The Core Lightning episode and the Liquid dispute also show a cost that the triumphant coverage skips. A volunteer group that holds thousands of undisclosed findings, and that publicly shames vendors, becomes a source of friction as well as protection. Core Lightning credited its reports to "multiple sources" and did not name the Red Team.28 On Liquid, the two sides have not yet published their competing accounts.32

The reading

For the open-source ecosystem, this is the clearest evidence yet that AI-assisted auditing is now a normal part of maintenance, not an optional extra. Calle argues that projects that began AI audits months ago are "in a completely different position" than those that did not, and that each project needs its own audit pipeline.1 He also warns against trusting unmaintained software.3 His view that AI has removed the information gap that "security through obscurity" depended on is plausible given what has happened since July.5

The uncomfortable policy point is this. US labs' caution may be pushing serious defenders toward Chinese open-weight models, at a time when Anthropic has accused Moonshot and others of distilling Claude through fraudulent accounts.5 That is not an argument for dropping safeguards. Hugging Face's own disclosure explicitly declined to argue against hosted safety controls.18 It is an argument for refusal policies that can recognize authorized defensive work, because the open alternatives are now good enough that defenders will route around restrictions that block them. Calle expects Bitcoin to be only the first target, with other ecosystems following because money attracts attackers first.5 Maintainers outside crypto should take that warning seriously.