A volunteer group has spent the past stretch pointing AI models at Bitcoin’s codebases and publishing what came back. The numbers making the rounds today: roughly 85 critical bugs flagged, an average of about one critical finding per hour per person, at a compute cost of around $10,000 a day. One of the developers involved called the situation “extremely bad”.
The instinct is to read that as bad news about Bitcoin. It is not. It is news about auditing, and it is the most significant thing to happen to software verification in years. The genuinely bad news belongs to everyone running code that nobody is permitted to look at, which happens to describe almost every crypto casino you have ever placed a bet on.
TL;DR
- A volunteer effort running AI models against Bitcoin’s codebases is reporting roughly one critical bug per hour per researcher, around 85 flagged so far, at about $10,000 a day in compute.
- A finding rate is not a defect rate. That number measures how hard people are looking, not how bad the code is, and Bitcoin’s code did not get worse this week.
- The real story is that deep adversarial auditing just fell from a six-figure engagement to a compute bill, and that discount is only claimable on code somebody is allowed to read.
- Closed casino RNG gets none of the benefit and all of the exposure: it is still audited, just privately, by whoever gets inside, and they do not file reports.
- Satoshie’s contracts are verified on Base, which means the same tooling can be pointed at us by anyone, at any time, without asking. That is the trade, and it is the right one.
A finding rate is not a defect rate
This is the part almost every headline gets wrong. Eighty-five critical bugs sounds like a verdict on Bitcoin’s engineering. It is not. It is a verdict on the intensity of inspection.
Bitcoin’s codebase did not deteriorate this week. What changed is that a group of people acquired a tool that reads code faster than humans do, pointed it at a target that is fully public, and published the results in the open while the fixes were still being written. The number is high because the looking is hard, sustained, and permitted.
Now hold that next to a crypto casino that has disclosed zero critical bugs in its game engine. Those two numbers are not comparable, because they are measurements of different things. One is a property of a codebase under adversarial review. The other is a property of an audience that was never given the file.
What actually changed is the price
Security auditing used to be priced like a legal engagement. Six figures, weeks of calendar time, a scope negotiated in advance, and one point-in-time PDF that started going stale the moment the next commit landed. That pricing shaped behaviour: you did one audit, at launch, then put the logo in your footer for three years.
At roughly $10,000 a day in compute, that entire model comes apart. Adversarial review stops being a capital expense you budget for annually and becomes something closer to a background process. More importantly, it stops being something only the code’s owner can commission. That is the shift that matters.
The discount only applies to code you can read
Here is where it gets uncomfortable for most of crypto gaming. A collapse in the cost of auditing is only claimable on a codebase somebody is permitted to audit. Bitcoin qualifies. So does every verified contract on Base. A house RNG running on a server in a jurisdiction the operator declines to name does not.
The operator can, of course, point AI at their own backend. Some will. You will never see the output, and neither will anyone with an incentive to publish it. The bugs do not disappear because nobody wrote them down; only the reports do.
And it cuts deeper than that. The same price collapse arms whoever does get access: a breached server, a leaked repository, a contractor who kept a copy of the backend on the way out. Closed source has never meant unaudited. It means audited privately, by parties who chose not to tell you, on a timeline you do not control. The 85 number is what an audit looks like when it happens out loud. The alternative is not zero bugs. It is the same audit, conducted by someone with a different plan for the findings.
Yes, this points at us too
Satoshie’s contracts are verified on Base. That means anyone reading this can copy the source into a frontier model this afternoon and ask it, in plain English, to find a way to take the money. Some people already have. More will now that the price is what it is.
That is the trade, and we think it is obviously the correct one. A public bug has a public fix, a deployment history anyone can diff, and a clock that every observer can see running. A private bug has an incident that nobody announces, a database that quietly gets reconciled, and a support ticket that says “technical issue” and closes.
There is a second-order effect worth naming. “Audited in 2024” was always a weaker claim than it looked, and it is weaker now. An audit is a snapshot taken by one team, under one scope, on one day. The Coldcard entropy flaw made that painfully concrete: auditors confirmed the intended random number generator was present in the codebase, not that anything actually called it, and the gap between presence and invocation survived five years of review. A verified contract does not fix that by itself, but it does make the check repeatable by strangers, on any day, without your cooperation. Permanent auditability beats a certificate.
What this means for fairness specifically
The surface that determines whether you were treated fairly in an on-chain game is small: where the randomness comes from, how the outcome is computed from it, and how the payout executes. On Satoshie that is a Chainlink VRF request, a resolution that happens inside the VRF callback transaction, and a payout in the same transaction. It is a few hundred lines, it is verified, and it is now cheap for a stranger to interrogate with better tooling than any of us had a year ago.
For a closed casino, that same surface is precisely the part that will never be published, because publishing it is the whole business risk. The marketing site can promise provable fairness in a font size of your choosing. The code that decides your coinflip stays behind the API, where the new auditing economics cannot reach it and the old ones never did.
Two honest caveats. AI-generated findings are noisy, and “critical” is doing a great deal of work in any self-reported count; the right response to 85 is not to take the figure at face value, but to notice that it exists publicly at all, before the patches shipped. And none of this protects the interface. Our own front end is a normal web application with the normal weaknesses, as we have said before. The narrow claim is that everything determining who won and who gets paid happens somewhere the interface cannot reach, in code you can now audit for the price of a compute run.
Three questions worth asking
- Can you obtain the code that decides your bet? Not the marketing description of it, not a summary in a whitepaper, the actual deployed code.
- If you found a flaw in it, could you prove the flaw to anyone else without the operator’s cooperation?
- When was that code last examined by someone who does not get paid by the house, and could you be that someone this afternoon?
If the answer to all three is no, the platform has not proven it has fewer bugs than Bitcoin. It has proven that nobody is counting.
📷 Photo by Chris Ried on Unsplash
