Bitcoin Red Team Uses Moonshot Kimi to Flag Nearly 8,000 Issues in Open‑Source Projects

Overview

• The volunteer Bitcoin Red Team reported Friday that it scanned 501 Bitcoin‑related open‑source projects with Moonshot AI’s Kimi K3 and logged 7,958 potential findings after about 108 hours of work.
• Researchers rated 1,280 findings as high or critical but had dynamically reproduced only about 24.7% of all items and reported roughly 29.4% upstream at the 108‑hour mark, so most items still need human verification.
• Kimi K3 became the primary tool because researchers can run it locally to avoid usage restrictions on U.S. commercial models, and independent assessments found it outperformed GLM‑5.2 on exploit tests while trailing the strongest closed models.
• Maintainers have already validated and patched serious bugs, with BTCPay Server crediting researchers for fixing a two‑factor authentication bypass that had been actively exploited and releasing follow‑up security updates.
• The campaign exposes a verification bottleneck that is straining maintainers, increases pressure to fund continuous AI audit pipelines, and warns users to treat unmaintained wallets, Lightning services, and old libraries with greater caution.