Bitcoin contributor fixes wallet crash bug using AI tools, exposing both promise and friction in AI-powered security

Rob Hamilton, CEO of AnchorWatch and a Bitcoin contributor, got his first commit merged into Bitcoin Core on August 20. The fix addressed a wallet-related bug, and the interesting part is how he found it: by pointing AI models at Bitcoin's codebase and letting them hunt for problems.

Hamilton's effort is part of a broader initiative he calls the "Bitcoin Red Team," a volunteer-driven campaign that uses AI to systematically audit Bitcoin-related open-source code. The project has already surfaced thousands of potential issues, including dozens classified as critical. It also revealed something uncomfortable about the current state of AI-powered security research: the tools you need can be yanked away mid-audit.

The Red Team consists of Hamilton and 16 volunteers who launched their first major push in early August. In roughly 30 hours, the group documented 4,962 findings across more than 390 Bitcoin-related open-source repositories. Of those, 85 were flagged as critical and 635 as high-severity.

Hamilton had been experimenting with AI-assisted code analysis on Bitcoin Core as early as May. The catalyst that turned a solo experiment into a coordinated campaign was a Coldcard hardware wallet vulnerability in July that led to the theft of over 1,000 BTC.