AI is now hunting crypto security bugs, and both sides want the best tools

More than three dozen Bitcoin and crypto companies have signed an open letter asking the biggest AI labs to give open-source security researchers early access to their most powerful models. The argument is uncomfortable but simple: the people defending crypto's infrastructure are working with weaker AI tools than the people attacking it.

The letter was organized by the Bitcoin Policy Institute and signed by names including Coinbase, Block, BitGo, Blockstream, Anchorage Digital, ARK Invest, Bitwise, Casa and Exodus, along with nonprofit developer funds like Brink and Chaincode. Its core complaint is that Bitcoin Core developers, the small group that maintains the software running the network, are shut out of the private programs AI labs offer to trusted security partners.

When those developers use ordinary public AI models instead, the safety filters meant to stop people from writing malware also get in the way of legitimate work: finding flaws before criminals do. That leaves defenders relying on weaker, freely downloadable models, while attackers face none of the same limits. The signers asked for five things, including early access to the strongest models, computing resources, and a direct line to the labs' security teams.

The timing was not an accident. Just last week BTCPay Server, one of the companies that signed the letter, disclosed a serious flaw that attackers had already used to drain funds from Lightning nodes belonging to merchants. Foundation, a hardware-wallet maker that also signed, lost its own node in the same attack. The flaw was eventually caught by a volunteer group calling itself the Bitcoin Red Team, which has been pointing AI models at Bitcoin's code and filing thousands of findings across hundreds of projects.

For a beginner, the useful takeaway is not the politics of who gets which AI model. It is that AI is speeding up both attack and defense in crypto, which makes ordinary security habits matter more than ever. Keep the software behind your wallet, node or payment tool up to date, since these disclosures usually arrive with a patch. And treat any tool that touches real money as something worth updating promptly, not later.