Skip to content

Project

Bitcoin Red Team

Volunteer effort that used AI agents to identify thousands of potential vulnerabilities across hundreds of Bitcoin projects.

Known aliases

  • Red Team

Current stories

investConfirmed2 publishers

Google's PageBreak agent confirmed two XSS flaws on hardened frameworks against more than 500 elsewhere

Google's PageBreak agent confirmed over 500 XSS flaws in ordinary Google web apps and two in hundreds built on its hardened frameworks. The gap supports building defences into frameworks, and the agent that measured it had more inside access than an outside attacker would.

Reality

Evidence55
Adoption20
Hype gap+20
Incentives65
Confidence55
investConfirmed3 publishers

Ten days of maintainer time bought Core Lightning a two-week embargo on AI-found bugs

Core Lightning says the machine-written reports found real flaws in its payments software. It is holding the count and severity for at least two weeks, leaving node operators to decide what to do with a hazard whose size is still private.

Perspective Coverage

3 publishers
Builder
Builder 28%
Operator
Operator 52%
Investor
Investor 20%

Reality

Evidence60
Adoption40
Hype gap+25
Incentives68
Confidence62
investConfirmed3 publishers

Harmony offers validators nine times its DeFi TVL to switch off its own chain

Harmony blames state actors and AI agents for shutting the layer-1 it launched in 2019, and the money set aside to pay validators to power down is worth more than everything left locked on the chain it closes.

Perspective Coverage

3 publishers
Builder
Builder 30%
Operator
Operator 38%
Investor
Investor 32%

Reality

Evidence55
Adoption20
Hype gap+45
Incentives75
Confidence60
investOne report1 publisher

The $20,000 red team: US guardrails push Bitcoin's defenders onto Chinese models

A volunteer group says it has swept almost all of Bitcoin's open-source ecosystem for AI-assisted exploits, and that American models' refusals made Chinese ones the default tool.

Publishers:decrypt.co

Reality

Evidence28
Adoption32
Hype gap+34
Incentives66
Confidence44
investOne report1 publisher

Coinkite now makes Coldcard owners roll dice, after $130M walked out of air-gapped wallets

A 2021 seed flaw cut entropy from 128 bits to about 40, so no attacker needed to touch the hardware. Every seed generated before July 2026 now has to be replaced.

Publishers:decrypt.co

Reality

Evidence62
Adoption54
Hype gap+14
Incentives66
Confidence58