Bitcoin Red Team Uses Chinese AI Models to Find 4,900 Security Flaws in 390 Projects

A pseudonymous developer going by Calle just ran one of the largest security audits Bitcoin’s open-source ecosystem has seen, and did it by pointing Chinese AI models at nearly 400 projects most users have never heard of.

The Bitcoin Red Team combined AI-assisted scanning with human review across wallets, Lightning applications, and software libraries, using Moonshot AI’s Kimi K3 and Z.ai’s GLM 5.2 as the core tools rather than OpenAI or Anthropic’s models, which the team says impose restrictions that get in the way of this kind of security research. The August sweep alone produced more than 4,900 findings across 390 projects, including 85 rated critical and 635 rated high severity.

Separately, Spiral, the Block-backed open-source Bitcoin development group, released its own free tool called Loupe, built specifically to run continuous automated vulnerability scans on Bitcoin projects throughout development rather than as a one-time audit.

The choice to lean on Chinese AI models for security research most directly aimed at protecting Bitcoin infrastructure is a detail worth sitting with on its own, whatever the practical justification. But the underlying finding, thousands of real vulnerabilities sitting undiscovered across the software wallets and everyday users actually rely on, is the part that should concern anyone running one of these 390 projects.

Want to understand how open-source Bitcoin software actually gets reviewed and secured? Learn more in the Bitcoin Academy.