Loading today’s stories
Invest1 distinct publisher2 min readUpdated
A volunteer group says it has swept almost all of Bitcoin's open-source ecosystem for AI-assisted exploits, and that American models' refusals made Chinese ones the default tool.
The Investor · Invest desk
Compiled by The InvestorSomething wrong?How this is made
A refusal is not a control, it is a routing decision. Calle told Decrypt that American models sometimes declined to help him locate vulnerabilities, and in some cases would not help fix ones that had already been found [6]. Nobody appeals that. They open a different tab.
What follows is a split between the people who can make that move and the people who cannot. The group's trigger, by Calle's account, was AnchorWatch chief executive Rob Hamilton going through Bitcoin projects after the Coldcard air-gapped wallet hack [11], and its working output is a loop with maintainers whose feedback it uses to sharpen its own severity ratings [15]. That is unfunded and unaccountable, and it is also fast. An insurer or an exchange attempting the same sweeps under a written model-use policy is slower by construction, and pays more for inference that Calle himself says will refuse some of the questions [6].
Then the arithmetic. Hamilton's spend figure, spread across the roster, comes to roughly $800 to $1,000 per participant [16]. Small money for the breadth being claimed, and it points at where the scarcity actually sits: not compute, but the two dozen or so people who can tell a real finding from noise [1].
Calle credits the release of Kimi K3 with upending his field, saying it "gave attackers as well as defenders unprecedented power" [12]. The awkward part is provenance. Anthropic said in February that DeepSeek, Moonshot AI and MiniMax used roughly 24,000 fraudulent accounts to extract more than 16 million Claude exchanges through model distillation [13], which works out to about 667 exchanges per account [17], a pattern closer to patient bulk collection than to a few heavy users. The Trump administration said in April that Chinese entities were running campaigns of that kind at industrial scale [14]. If those accounts hold, the models now doing Bitcoin's defensive scanning were assembled in part from the outputs of the model that will not answer the question.
One caution on the whole picture. The usage claim rests on a single pseudonymous member speaking to one publication, with no metered comparison offered [4], and the only public number attached to the effort is a spend total posted by the person who started it [10]. Take the direction and discount the magnitude.
The narrow version of the problem, for anyone drafting a security line item, is that the permitted tool and the effective tool are no longer the same vendor, and the volunteers have already shown which one gets used when there is no procurement process to satisfy.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Calle said the Bitcoin Red Team formed as an emergency effort to find AI-assisted security threats across the Bitcoin ecosystem, and exists to get ahead of attackers as fast as possible.
Calle said Chinese AI models are used far more than U.S. models for the group's security research because American models often block cybersecurity-related requests, adding: "It's not even close."
Calle said U.S.-based frontier models are still arguably more intelligent than any other models in the world, but come with heavy guardrailing that limits their use in the cybersecurity realm.
Calle said U.S. models sometimes refused to help find vulnerabilities and, in some cases, would not assist with fixing vulnerabilities.
Calle warned that AI allows people without advanced security expertise to carry out exploits from beginning to end.
In an August 4, 2026 update, Rob Hamilton said the Bitcoin Red Team had been working around the clock with about $20,000 of spend to that point across different services, that funding is secured, and that donations are not necessary.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single interview, no verifiable artifacts
One publisher, one pseudonymous interviewee, and one embedded dated post carry the entire story. The strongest documented item is Hamilton's August 4, 2026 spend update; the load-bearing claims — near-total ecosystem sweep coverage, model refusals, Chinese-model dominance in the group's workflow — have no repository lists, advisories, CVE identifiers, logs or corroborating voices. Vendors and labs named in the piece are unrebutted because they were not asked.
Real but small and unaudited activity
There is concrete evidence of an operating effort: a 20-25 person volunteer roster with named participants, about $20,000 of secured service spend by August 4, 2026, 'over a dozen' engagements, and a findings-sharing loop with maintainers. What cannot be measured is reach: no count of projects scanned, no published advisories, and no maintainer confirming a fix, so the claimed near-complete ecosystem coverage is not observable adoption.
Framing outruns the documentation
The story's sweeping formulations — 'almost the entire significant open-source ecosystem', 'no secrets anymore in software', 'Bitcoin is burning', geopolitical model-choice framing — rest on one interested participant's account, while the piece simultaneously reports the reassuring finding that no protocol-level issue was found. Derived per-head and per-account ratios add apparent precision to figures that do not support it. The gap is overstatement of certainty and scale, not invention: the underlying activity and the guardrail friction are plausibly real.
Interested parties throughout, disclosed but unbalanced
Every substantive claim comes from someone with a stake: Calle is a Red Team member and Cashu maintainer describing his own group's coverage; the effort was catalyzed by the CEO of AnchorWatch, a Bitcoin insurance firm, who also publishes its progress updates; and the distillation allegations originate with Anthropic, a direct commercial rival of the Chinese labs whose models the group says it prefers. Decrypt discloses the affiliations but includes no adversarial voice.
High confidence in what was said, low in what is true
The quotations, roster, dated spend post and affiliations are clearly reported and internally consistent, so attribution-level claims can be stated with confidence. Assessment of the substance — sweep coverage, the actual balance of model usage, the vendor refusal pattern, the Coldcard incident — is constrained by a single publisher, a single interviewee and zero corroborating documents.
product
Incogni ranks 13 AI assistants by privacy risk: bigger is worse, except ChatGPT1 distinct publisher
build
1.5% of Hugging Face repos take 99.2% of downloads, and the ceiling is Chinese1 distinct publisher
invest
The chips never move: Washington's fix for the Southeast Asia compute loophole1 distinct publisher
science
Claude's watermark is a compliance artefact, not a cheating detector1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 22, 2026