BITCOIN RED TEAM — 27.5 HOURS, 390 REPOS, 85 CRITICAL, HARNESS OPEN-SOURCED

The Tech read. Rob Hamilton and Calle led a 16-person Bitcoin Red Team sprint that ran an AI harness across 390 repositories in the Bitcoin ecosystem — wallets, Lightning implementations, hardware firmware, custody stacks, mempool tooling. Compute budget: roughly $40K in OpenSats-funded credits. Elapsed time: 27.5 hours. Total findings: 4,962. Critical: 85. High: 635. The harness itself will be open-sourced. That last part is the point.

The model stack. The harness ran on Kimi K3, GPT Sol, Fable, Opus, and GLM 5.2. Note the composition: the most capable freely deployable tooling at sprint-time was Chinese open-weight (Kimi K3 and GLM 5.2), before OpenAI access came online. That is an access-constraint story hiding inside a security story. For an ecosystem that runs on open-source values, the finding is: the frontier weights that closed-labs release under commercial-only terms are not available to the volunteer defender. The frontier weights that Chinese labs release under permissive terms are. The Red Team ran on both. The math is the math.

The outreach wall. Marty Bent's Aug 7 Bitcoin Brief framed the next problem accurately: finding the bugs is the easy part; getting them triaged and patched by the maintainer of each affected project is the hard part. Bitcoin's protocol-adjacent code surface is far larger than Core. Each of 390 repositories has a different maintainer, a different security-disclosure process, and a different bandwidth for reviewing an incoming AI-generated finding. The harness output is not usable as a patch; it is usable as an entry point to a conversation with a maintainer who may or may not have the time. The Red Team can find the bugs. The maintainer network has to close them. Both parts need to work.

Why the operator class should care. Every self-custody solution, every Lightning wallet, every hardware device firmware sits on top of code that has never received a coordinated adversarial review at this scale. The Coldcard firmware entropy bug from five years ago was in that surface. The Boltz shutdown last week was in that surface. The Zeus outage was in that surface. The Red Team is doing what nobody was doing at scale — a coordinated adversarial pass. When the harness ships open-source, any team can rerun it on their own code before shipping. That is protocol-adjacent hygiene converting from "there should be" to "there is."