Artificial intelligence has put powerful hacking tools into the hands of a vast number of individuals lacking cybersecurity expertise. Cryptocurrency developers are now forced into a race against time: they must identify system vulnerabilities before attackers do.

Bitcoin Red Team is the group rising to meet this challenge. Calle, an anonymous member and Bitcoin software developer, explains that the team was formed specifically to urgently respond to AI-augmented security threats emerging across the Bitcoin ecosystem.

“It’s just a matter of time now,” Calle told Decrypt, “The reason Bitcoin Red Team exists is so we can stay as far ahead of attackers as possible.”

According to Calle, the Bitcoin Red Team consists of 20–25 volunteers, many of whom choose to remain anonymous—such as Stu and Talip, developers of the Bitcoin privacy protocol, and thesimplekid, who also maintains Cashu. Other team members include Bitcoin developers Ben Carmen, Daniela Brozzoni, James O'Beirne, and Bruno Garcia, board member at Vinteum Bitcoin Research Center.

Calle notes that Rob Hamilton, CEO of AnchorWatch, a Bitcoin insurance firm, began auditing various Bitcoin projects following the hacker breach of Coldcard offline hardware wallets, which ultimately led to the gradual formation of the Bitcoin Red Team.

Calle emphasizes that the team has not found any inherent flaws in the Bitcoin core protocol itself, but rather that risks are concentrated in wallets, applications, services, and other third-party software built atop Bitcoin.

“The Bitcoin protocol itself is secure, but the software ordinary users rely on for Bitcoin transactions may not be. And most users interact only with these upper-layer applications,” he said.

The compromise of Coldcard wallets, multiple attacks on Bitcoin-related services, and the emergence of increasingly powerful Chinese AI models have driven Calle and other security researchers to accelerate their efforts in vulnerability discovery.

“I believe the launch of Kimi K3 has caused massive disruption in the cybersecurity space—it grants both attackers and defenders unprecedented capabilities,” he stated.

Calle explains that the red team receives security scan requests from Bitcoin projects while also proactively hunting for vulnerabilities.

“Many projects come to us directly requesting scans, but we also take the initiative. Through proactive reconnaissance, we’ve nearly covered all major open-source projects within the ecosystem. So even if a project comes to us now, it’s likely we’ve already scanned it.”

The team reports findings to respective project developers and refines vulnerability classification standards and risk rating rules based on developer feedback.

Chinese AI Models Fill the Tooling Gap

Calle notes that during their security work, Chinese AI models are used far more frequently than American counterparts—primarily because U.S.-based models have built-in safety mechanisms that block cybersecurity research tasks.

“The difference is stark,” he says.

In February, Anthropic accused Chinese AI labs DeepSeek, Moonshot AI, and MiniMax of using around 24,000 fake accounts to steal over 16 million Claude conversation instances via model distillation techniques. Then, in April, the Trump administration issued warnings that Chinese entities were conducting similar thefts at an “industrial scale.”

Calle believes that although U.S. frontier large models still lead in overall capability, stringent content restrictions significantly reduce their utility in security-related work.

“Undeniably, top-tier U.S. large models still lead globally in general intelligence, but they are heavily guarded by protective barriers—restricting their use, especially in cybersecurity.”

Before joining the red team, Calle personally experienced these limitations. He recalls that U.S. AI models sometimes refuse to assist in vulnerability discovery; even when developers confirm a vulnerability, the models often decline to provide remediation guidance—prompting him to switch to Chinese AI models.

“Bitcoin Is Burning”

Earlier this month, Calle described the growing security threats facing Bitcoin software as “Bitcoin is burning”—where “Bitcoin” here refers to wallets, exchanges, Lightning Network implementations, and all surrounding software ecosystems built on top of Bitcoin.

Calle believes attackers are already leveraging artificial intelligence to discover and exploit vulnerabilities. However, to avoid providing malicious hackers with attack vectors, he refuses to detail specific attacker methodologies.

He also warns that previously, certain software vulnerabilities were inaccessible to less technically skilled attackers due to information asymmetry. But AI is erasing that barrier.

“There are no secrets left in software. The old model of security through information asymmetry, or obscurity-based security relying on undisclosed details—this era is over.”

AI has also lowered the technical barrier to exploiting vulnerabilities.

“Now, someone without technical expertise can use AI to carry out exploitation of simple vulnerabilities from start to finish. This capability granted to ordinary people by AI has completely rewritten the balance of offensive and defensive strategies.”

Calle believes that cryptocurrencies offer direct financial incentives, giving attackers strong monetary motivation, which means Bitcoin will face this shift earlier than other industries.

“Attackers’ first targets will always be internet-native digital currencies. We are at the dawn of a massive transformation across the entire computing industry—I’m certain other sectors will soon face the same security challenges we’re confronting today.”

By: Jason Nelson, Translated by: Saoirse, Foresight News