A volunteer team specializing in the screening of the Bitcoin software leaks stated that the China AI model had been used to complete the basic scan of almost the entire Bitcoin open source ecology and had submitted a large number of safety reports to developers.
At the social platform, Bitcoin Red team leader and pseudonym developer Calle stated that the team combines the AI tool with manual review to check wallets, lightning network applications, software libraries, etc. The team will inform the developer, in private, of the restoration before making the details public.
390 projects covered
Calle disclosed that in August the team had submitted 4962 problem notes to 390 projects, of which 85 were serious, 635 were high-risk and the rest were security at different levels.
He indicated that developers had identified a number of real serious and high-risk loopholes. However, the team did not disclose the names of the projects affected, nor did it disclose the technical details.
The Chinese model was used for code audits
The team used models such as Kimi K3 of Moonshot AI and GM 5.2 of the Chinese developer platform Z.ai, as well as OpenAI and Anthropic models.
According to Calle, the U.S. production model is limited in use in a safety-research scenario, and the team has been constrained repeatedly during the audit process and has moved to a locally run Chinese model. Kimi K3 is described as capable of processing large code libraries and performing longer software analysis tasks with less manual intervention.
It's more difficult to review a lightning network project.
Calle stated that support for fast-paying lightning network software in Bitcoin was significantly more difficult to review because of its complex structure and the overall problem profile was more prominent than the general project.
He also indicated that the project that had introduced the AI audit process earlier had created a gap between the current situation and those that did not use the relevant tools. In the future, project parties need to establish their own AI audit process, and long-standing software that lacks maintenance should not continue to be easily trusted.
As he put it, AI is increasing the efficiency of detection of loopholes, but it is also synchronizing the pressure of developers to maintain security. While he described the current situation as “bitcoin burning”, he believed that large-scale audits would in turn contribute to a stronger Bitcoin software.