The $20,000 red team: US guardrails push Bitcoin's defenders onto Chinese models

A refusal is not a control, it is a routing decision. Calle told Decrypt that American models sometimes declined to help him locate vulnerabilities, and in some cases would not help fix ones that had already been found ^[4]. Nobody appeals that. They open a different tab.

What follows is a split between the people who can make that move and the people who cannot. The group's trigger, by Calle's account, was AnchorWatch chief executive Rob Hamilton going through Bitcoin projects after the Coldcard air-gapped wallet hack ^[7], and its working output is a loop with maintainers whose feedback it uses to sharpen its own severity ratings ^[11]. That is unfunded and unaccountable, and it is also fast. An insurer or an exchange attempting the same sweeps under a written model-use policy is slower by construction, and pays more for inference that Calle himself says will refuse some of the questions ^[4].

Then the arithmetic. Hamilton's spend figure, spread across the roster, comes to roughly $800 to $1,000 per participant ^[16]. Small money for the breadth being claimed, and it points at where the scarcity actually sits: not compute, but the two dozen or so people who can tell a real finding from noise ^[12].

Calle credits the release of Kimi K3 with upending his field, saying it "gave attackers as well as defenders unprecedented power" ^[8]. The awkward part is provenance. Anthropic said in February that DeepSeek, Moonshot AI and MiniMax used roughly 24,000 fraudulent accounts to extract more than 16 million Claude exchanges through model distillation ^[9], which works out to about 667 exchanges per account ^[17], a pattern closer to patient bulk collection than to a few heavy users. The Trump administration said in April that Chinese entities were running campaigns of that kind at industrial scale ^[10]. If those accounts hold, the models now doing Bitcoin's defensive scanning were assembled in part from the outputs of the model that will not answer the question.

One caution on the whole picture. The usage claim rests on a single pseudonymous member speaking to one publication, with no metered comparison offered ^[2], and the only public number attached to the effort is a spend total posted by the person who started it ^[6]. Take the direction and discount the magnitude.

The narrow version of the problem, for anyone drafting a security line item, is that the permitted tool and the effective tool are no longer the same vendor, and the volunteers have already shown which one gets used when there is no procurement process to satisfy.