The Bitcoin Red Team, a volunteer security research group led by a pseudonymous developer known as Calle, has been using Kimi K3 — an AI model from Chinese startup Moonshot AI — to scan Bitcoin's open-source ecosystem for vulnerabilities, logging thousands of findings across wallets, Lightning applications and software libraries over a roughly two-week audit.
The team's running tally reached 7,958 findings spanning approximately 390 projects, with 1,280 of those classified as high or critical severity. Of the full dataset, about 24.7% had been dynamically reproduced and confirmed as genuine, and 29.4% had already been reported upstream to the affected projects' maintainers at the time of the latest count — figures the team has been careful to frame as a security triage queue rather than proof of thousands of exploitable bugs in production.
Why an AI Model Built in China
Kimi K3 is designed to analyze large codebases and carry out extended software tasks with limited human supervision, and developers can download and run it locally on their own infrastructure. Calle said the team turned to Chinese-developed models in part because U.S.-developed AI models carry usage restrictions that apply specifically to security research scenarios, restrictions the team said they ran into repeatedly during the audit before switching to models that could run locally without those constraints.
The approach still combines AI with human oversight rather than relying on the model's output directly: findings flagged by Kimi K3 are verified by human researchers before being escalated, and credible vulnerabilities are reported privately to the affected projects' maintainers so fixes can ship before technical details become public — standard responsible-disclosure practice in security research.
Related: Bitcoin Longs Face Cleanout on Binance as BTC Eyes New August Lows
A Preview of AI-Assisted Auditing at Scale
Calle described the two-week engagement as exposing how quickly modern AI models can work through years of accumulated open-source code, calling it a “massive collision” between older software written without AI-assisted review in mind and frontier models now capable of parsing it at scale. Bitcoin's core software and the surrounding wallet and Lightning ecosystem have historically relied on a relatively small pool of expert human auditors, so a tool that can triage a large codebase quickly — even with a high false-positive rate — could meaningfully change how quickly newly discovered classes of bugs surface across the broader Bitcoin open-source stack, provided the human verification step keeps pace with the volume of AI-generated findings.
