Bitcoin security is facing an uncomfortable new reality: the software surrounding Bitcoin is becoming easier for AI to inspect, and that could change the economics of finding vulnerabilities.
A series of incidents has pushed the issue into sharper focus. Around $114 million in bitcoin was recently drained from Coldcard wallets, while developers behind Core Lightning issued an emergency response after AI-generated security reports exposed genuine vulnerabilities.
Then came Liquid Network. White-hat hackers exploited a flaw in Blockstream’s Bitcoin sidechain, withdrawing roughly 4,000 BTC worth about $317 million before returning 3,400 BTC after the vulnerability was fixed.
The incidents point to an awkward contradiction at the center of Bitcoin infrastructure. Bitcoin’s base layer is deliberately designed to remain relatively simple, limiting the amount of code that can go wrong.
But the moment developers start adding more speed, flexibility and functionality through smart contracts or off-chain systems, the software stack gets much more complicated. And complexity creates more places for something to break.
That tension matters because Layer 2 networks and other Bitcoin-related systems are where much of the experimentation now happens. They can expand what the network is capable of, but they also introduce codebases that are significantly more difficult to reason about than Bitcoin’s core protocol.
Bitcoin security meets an AI with time to read everything
The bigger change may not be the vulnerabilities themselves, but who—or what—is finding them.
In August, a group of 16 Bitcoin developers used AI models to examine 390 Bitcoin projects. The sweep generated nearly 5,000 findings, including 85 that were initially classified as critical.
Gregory, a Bitcoin application developer and the co-founder and CEO of CommerceBlock, argued that the technology is changing the economics of software auditing. Before CommerceBlock, he worked at Merrill Lynch and JPMorgan, and he has helped develop Bitcoin protocols including MainStay and the statechain technology behind Mercury Wallet and Mercury Layer.
“At some point we have to admit it. AI is finding bugs that no human can find,” Gregory said in a Telegram message.
That possibility creates a strange new problem for Bitcoin security. Old code has always been risky, but reviewing it has also been expensive and time-consuming. A repository could sit untouched for years simply because nobody had the resources—or motivation—to inspect every line.
AI changes that calculation.
Gregory pointed to Mercury Layer, which no longer operates but whose open-source code is still available on GitHub. He suggested that dormant financial software may deserve fresh scrutiny precisely because modern AI systems can analyze it at extremely low cost.
“If a model can wake a bug in finance C from 2006, it can probably read a statechain repo that has not moved,” he said.
He raised questions about possible weaknesses in Mercury’s older code, including key-share deletion, client-side transfer checks, backup transactions and its shrinking locktime mechanism.
That does not establish that those areas contain exploitable vulnerabilities. The point is broader: once the cost of examining forgotten software falls dramatically, code that once looked too obscure or unimportant to review becomes a much more attractive target for automated analysis.
“That is the new paradigm,” Gregory said. “Unused code stopped being unused the moment the cost of reading it dropped to zero.”
For Bitcoin security, that may be the most consequential lesson in the recent string of incidents. The code protecting billions in value is no longer being judged only by how carefully humans can inspect it. Increasingly, it is also being tested by machines that can scan enormous amounts of software, search for patterns and keep looking long after a human auditor would have moved on.
The result is a peculiar technological arms race: greater complexity creates more room for innovation, while AI makes that complexity cheaper to investigate—and potentially cheaper to attack.
Rest assured, this content is strictly educational and does not constitute financial advice.