Kimi K3 AI Audits Bitcoin Code for Vulnerabilities

Hamilton has said OpenAI restricted his access to its 'trust cyber' program and the Daybreak Blue cyber model mid-project, despite having already completed KYC and onboarding approval ^[2]. The block pushed the Bitcoin Red Team back toward Kimi K3, the open-weight model from China's Moonshot AI, as the audit's primary workhorse ^[1]. Hamilton did not hide his discomfort: "It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to conduct my research," he said ^[1]. Bull Bitcoin founder Francis Pouliot was blunter, saying "I have never seen OpenAI this cucked. It's cucked beyond belief now" after a Chinese model reviewed and helped patch an exploit that American models had refused to touch ^[1]. Galaxy's Alex Thorn framed the stakes in strategic terms: "Americans should not have to rely on Chinese AI to defend themselves, their projects, companies, or clients from cyber-attacks" ^[1]. One Bitcoin Core contributor summed up the contrast more bluntly, pairing a US model's hedging against a Chinese model that simply listed 78 critical vulnerabilities ^[1].

The scale of the effort becomes clear when its three public checkpoints are lined up. After the first 27.5-hour sprint, volunteers had scanned 390 open-source Bitcoin projects and logged 4,962 findings, including 85 rated critical and 635 rated high severity ^[3]. A 55-hour checkpoint pushed that to 425 projects and 6,700 total findings, with 1,029 (15.4%) rated high or critical ^[4]. By August 8, after more than 100 hours of work from roughly 16 globally distributed contributors ^[3], the count reached 501 projects and 7,958 findings, 1,280 of them high or critical ^[1]. The team spent more than $40,000 on AI compute to get there, burning roughly $10,000 a day at points ^[3]. Developer Calle, the team's co-lead, described the pace as roughly one critical exploit found per person per hour ^[3].

Not everyone treats the raw finding counts as an unqualified security win. In the first sprint, only about 21.4% of flagged issues were independently reproduced or confirmed as real vulnerabilities ^[3], and neither of the later checkpoints published an updated reproduction rate. Critic JW Weatherman argued the campaign could not properly triage the sheer volume of AI-flagged output it was generating ^[4]. The numbers around basic security hygiene reinforce the concern: only 19.5% of the scanned projects had a SECURITY.md file and just 13.1% listed a disclosed security contact email ^[4], and by the time some of these reports were published, only 19 of the scanned projects had completed upstream disclosure ^[3]. Hamilton himself has pointed to operations, disclosure handoff, and triage - not the discovery step - as the real bottleneck going forward ^[3].

The audit did not start as an abstract academic exercise. Coinkite's Coldcard hardware wallet had shipped a firmware flaw since version 4.0.0 in March 2021 that made its random key generation predictable ^[5]. Beginning around July 30, 2026, an attacker exploited that flaw to drain funds, eventually stealing more than $116 million (about 1,816 BTC) from over 5,200 addresses, with the effective strength of some keys collapsing from 128 bits to as low as 40 bits ^[5]. Forbes covered the incident under the headline "I Did Everything Right" ^[6]. That catastrophe is what galvanized volunteer Bitcoin developers to launch a large-scale, AI-assisted audit of the wider open-source ecosystem ^[5].

Beyond the headline finding counts, the audit is reshaping how some Bitcoin developers think about the tools they build with. Calle has argued publicly that the scale of memory-safety and cryptographic-library flaws uncovered means Bitcoin projects should stop writing security-critical code in C ^[1]. Hamilton has tied the effort back to Bitcoin's founding premise, saying "there is no Bitcoin without self custody. This is non negotiable" ^[3]. With Bitcoin Core itself excluded from the current scope and the focus instead on wallets, cryptographic libraries, and surrounding infrastructure ^[3], the unresolved question is whether the ecosystem can build durable disclosure and remediation processes fast enough to keep pace with how quickly cheap AI review can now generate new findings.