AI IS READING EVERY LINE OF OLD BITCOIN CODE FOR FREE NOW — COLDCARD, LIGHTNING AND LIQUID ALL BROKE IN THE LAYER ON TOP, AND THE BASE CHAIN DID NOT
The base layer is boring on purpose. The bugs live where the cleverness is.
Three hits in a matter of weeks. A Coldcard flaw drained about $114 million. Core Lightning shipped an emergency patch after AI-generated reports turned up real holes. Blockstream’s Liquid lost roughly 4,000 bitcoin, about $317 million, before most of it came back. Different projects, one pattern.
The pattern is the layers. Bitcoin’s base chain is kept deliberately simple: few moving parts, little to attack. The speed and the features live one level up — wallets, Lightning, sidechains — and that is where the code gets complicated, and where all three of these breaks happened. None of them touched the base chain. It sat there doing the one boring thing it does.
What changed is the cost of looking. In August a group of sixteen Bitcoin developers pointed AI models at 390 projects and got back almost 5,000 findings, 85 of them rated critical on a first pass. One of them, a developer named Gregory, put it plainly: unused code stopped being unused the moment the cost of reading it dropped to zero. Old software nobody had audited in years is now being read by a machine that never gets tired.
This is not a reason to fear Bitcoin. It is the argument for keeping the thing you actually hold as simple as it can be. Every layer you bolt on to make it do more is a layer someone — or something — can now read all night. The base chain is boring on purpose. After this month, boring looks like a security model.
At the time of this writing, bitcoin was $78,846 (Crypto.com, 11:59 AM ET, Sep 8).
The pattern is the layers. Bitcoin’s base chain is kept deliberately simple: few moving parts, little to attack. The speed and the features live one level up — wallets, Lightning, sidechains — and that is where the code gets complicated, and where all three of these breaks happened. None of them touched the base chain. It sat there doing the one boring thing it does.
What changed is the cost of looking. In August a group of sixteen Bitcoin developers pointed AI models at 390 projects and got back almost 5,000 findings, 85 of them rated critical on a first pass. One of them, a developer named Gregory, put it plainly: unused code stopped being unused the moment the cost of reading it dropped to zero. Old software nobody had audited in years is now being read by a machine that never gets tired.
This is not a reason to fear Bitcoin. It is the argument for keeping the thing you actually hold as simple as it can be. Every layer you bolt on to make it do more is a layer someone — or something — can now read all night. The base chain is boring on purpose. After this month, boring looks like a security model.
At the time of this writing, bitcoin was $78,846 (Crypto.com, 11:59 AM ET, Sep 8).
KEY RECEIPTS
Recent incidents: Coldcard wallet exploit drained ~$114M in bitcoin; Core Lightning shipped an emergency patch after AI-generated security reports found real vulnerabilities; Blockstream’s Liquid Network lost ~4,000 BTC (~$317M), with ~3,400 returned after a patch. (CoinDesk, James Van Straten, Sep 8.)
AI code sweep: in August, 16 Bitcoin developers ran AI models across 390 Bitcoin projects, producing ~5,000 findings, 85 rated critical on a first pass. (CoinDesk, Sep 8.)
Gregory (bitcoin developer, ex-CommerceBlock; MainStay / Mercury Layer): “AI is finding bugs that no human can find”; unused code stopped being unused once the cost of reading it fell to zero. (CoinDesk, Sep 8.)
Design context: Bitcoin’s base layer is intentionally minimal; the smart-contract and off-chain scaling layers (wallets, Lightning, sidechains) carry the complex, higher-risk code. All three incidents were above the base chain, not on it.
On the board: our own reads on the Coldcard exploit, the Core Lightning Docker patch, and the Liquid peg incident.
Not claimed: that Bitcoin’s base protocol is at risk, or that any specific unaudited codebase is currently exploitable.
AI code sweep: in August, 16 Bitcoin developers ran AI models across 390 Bitcoin projects, producing ~5,000 findings, 85 rated critical on a first pass. (CoinDesk, Sep 8.)
Gregory (bitcoin developer, ex-CommerceBlock; MainStay / Mercury Layer): “AI is finding bugs that no human can find”; unused code stopped being unused once the cost of reading it fell to zero. (CoinDesk, Sep 8.)
Design context: Bitcoin’s base layer is intentionally minimal; the smart-contract and off-chain scaling layers (wallets, Lightning, sidechains) carry the complex, higher-risk code. All three incidents were above the base chain, not on it.
On the board: our own reads on the Coldcard exploit, the Core Lightning Docker patch, and the Liquid peg incident.
Not claimed: that Bitcoin’s base protocol is at risk, or that any specific unaudited codebase is currently exploitable.
THE BASE CHAIN HELD. EVERY BUG WAS IN THE LAYER ON TOP.
CoinDesk (James Van Straten) · Tue Sep 8 · + Coldcard / CLN / Liquid chain reads