The one that looked through the most Bitcoin ecosystem code wasn't a person but a Chinese AI model.
The crypto media outlet Coin Bureau posted the news on X at 4:30 a.m. KST on August 14, 2026 (original post). The Bitcoin Red Team used Moonshot AI's Kimi K3 as its main tool to scan open-source code and found about 8,000 flaws.
Why a Chinese AI?
The reason Coin Bureau cited was access. As U.S. AI labs restricted model access for security work, the team made Kimi K3 its main weapon.
The Bitcoin Red Team is a volunteer security audit group reportedly led by an anonymous developer, "Calle." In an earlier August 9 post, it said the group formed after the $130 million Coldcard wallet exploit, and that using Kimi K3, GPT Sol, and Opus it found 4,962 flaws across 390 projects in 30 hours.
In this August 14 updated post, it reported cumulative results of "about 8,000 found, 1,280 rated critical or high."
Before You Take the Numbers at Face Value
Several outlets covered the news. Decrypt, crypto.news, and others reported "7,958 found, about 390 projects, 1,280 critical or high." The "501 projects" Coin Bureau gave in this post differs from the "about 390" in other outlets. The exact project count is reported differently depending on the outlet and tally date, so this post does not settle it.
Also, as pointed out in the X comments, "8,000 flaws found" does not mean "8,000 critical vulnerabilities." The number of potential issues an AI flagged is different from the number confirmed as actually exploitable vulnerabilities. The key figure in this reporting is that 1,280 of the confirmed items were classified as critical or high.
Treat AI-Found Vulnerabilities as Candidates to Verify
What this case shows is that auditing a large open-source ecosystem exhaustively by hand is practically impossible, and that AI has started to close that gap. But the problems it finds only become real security improvements after maintainers verify and patch them.
For organizations that run security teams, the practical lesson here is to treat AI scan results not as "confirmed vulnerabilities" but as "a candidate list that people need to prioritize."
The Original Bitcoin Audit Is Unconfirmed
The Coin Bureau account describes itself as the "Official Coin Bureau X account," but I could not directly confirm the Bitcoin Red Team's official report during this verification. Discrepancies in detailed figures such as the project count remain unconfirmed until the original report can be checked.