A wave of security incidents involving Coldcard, Core Lightning and Liquid Network is highlighting the growing role of artificial intelligence in uncovering vulnerabilities across Bitcoin’s technical infrastructure.
Several major security problems have emerged across the Bitcoin ecosystem in recent months, raising concerns that AI could dramatically lower the cost of identifying flaws buried within sophisticated financial software.
Coldcard wallets were recently hit by an attack that drained approximately $114 million in bitcoin (BTC). Separately, Core Lightning developers issued an emergency alert after AI-assisted analysis identified genuine security weaknesses. More recently, white-hat hackers exploited a vulnerability in Blockstream’s Liquid Network, taking around 4,000 BTC worth roughly $317 million before returning 3,400 BTC after the flaw was patched.
The incidents reveal a growing tension in Bitcoin’s evolution. The network’s base layer has deliberately been kept simple to reduce potential security risks. But efforts to make Bitcoin faster and more functional through smart contracts and off-chain scaling systems have introduced increasingly complicated layers of software, creating additional areas where vulnerabilities can emerge.
AI is now adding another dimension to that security challenge by allowing researchers to inspect code on a much broader scale. In August, a team of 16 Bitcoin developers used AI models to scan 390 Bitcoin projects. Their effort produced nearly 5,000 potential findings, with 85 initially classified as critical.
“At some point we have to admit it. AI is finding bugs that no human can find,” Gregory said in a Telegram message.
Gregory, a Bitcoin application developer, previously worked at Merrill Lynch and JPMorgan before co-founding CommerceBlock, where he served as CEO. He was involved in developing Bitcoin protocols including MainStay and the statechain technology behind Mercury Wallet and Mercury Layer.
While Mercury Layer is no longer active, its open-source software remains available on GitHub. Gregory said AI has fundamentally altered the risk profile of older financial software because models can now examine dormant code at a fraction of the previous cost.
“If a model can wake a bug in finance C from 2006, it can probably read a statechain repo that has not moved,” he said.
That possibility raises questions about whether unaddressed vulnerabilities could remain hidden in Mercury’s legacy code. Gregory highlighted areas such as key-share deletion, client-side transfer checks, backup transactions and the shrinking locktime mechanism as potential areas requiring scrutiny.
“That is the new paradigm,” Gregory said. “Unused code stopped being unused the moment the cost of reading it dropped to zero.”
