Key facts
- Bitcoin developers are using Chinese open-source AI models due to restrictions on U.S. models like OpenAI's.
- U.S. AI models have reportedly blocked legitimate cybersecurity research and code review.
- Chinese models like Kimi K3 have successfully identified and helped patch vulnerabilities.
- A recent exploit in Coldcard hardware wallets highlighted the need for robust AI-assisted security audits.
- A Bitcoin Red Team effort used AI to scan over 500 open-source projects, finding thousands of vulnerabilities.
Bitcoin industry leaders and open-source developers are increasingly turning to Chinese open-source AI models for cybersecurity research, citing significant restrictions on U.S. frontier AI systems from companies like OpenAI and Anthropic. These U.S. models have reportedly blocked legitimate security work, forcing researchers to seek alternatives to protect critical Bitcoin infrastructure.
Rob Hamilton, CEO of AnchorWatch, expressed frustration with U.S. AI restrictions, stating he must use Chinese open-source models for research despite being a patriotic American. He reported being blocked from analyzing codebases even after responsible disclosure and gaining access to OpenAI's cyber model. Francis Pouliot, founder of Bull Bitcoin, echoed these sentiments, describing the situation as "cucked beyond belief" and noting that open-source Chinese models like Kimi K3 have proven effective in identifying and patching exploits, while U.S. models refused to review the same patches.
PortlandHODL, a Bitcoin Core contributor, highlighted a stark performance difference, with a Chinese model finding "78 critical vulnerabilities" where a U.S. model offered less. Alex Thorn, Head of Firmwide Research at Galaxy, signed an open letter from the Bitcoin Policy Institute, which calls for trusted access programs for qualified open-source and digital-asset defenders. The letter argues that current restrictions leave legitimate researchers disadvantaged against sophisticated attackers.
The cybersecurity pressure intensified following a July 30 exploit of a Coldcard hardware wallet firmware flaw, which resulted in the theft of over $100 million in bitcoin. In response, a volunteer Bitcoin Red Team, led by Calle and Rob Hamilton, conducted AI-assisted audits of Bitcoin open-source repositories. Using models like Kimi K3 as their primary tool, they scanned 501 projects and identified 7,958 findings, with 1,280 rated high or critical severity. The majority of computational resources were spent on Chinese open-weight models.
Lessons from the Red Team campaign indicate that the era of human-only open-source security review is over, with AI verification becoming essential. Developers are advised to maintain permanent AI audit pipelines and consider languages other than C for security-critical code, as memory-safety vulnerabilities are more easily exploited with current AI capabilities.