Bitcoin firms ask AI labs for same tools attackers already have

A letter signed by over three dozen Bitcoin and crypto companies has been delivered to the largest AI labs, urging them to provide early access to their most powerful models. These companies, including Coinbase, Block, BitGo, and others, argue that security researchers defending a trillion-dollar infrastructure are working with weaker tools than those launching attacks.

The main issue lies with Bitcoin Core developers, who cannot access the advanced programs used by labs for trusted security partners. Publicly available models, though, are less capable due to safety filters designed to prevent malware creation, which hinders the discovery of flaws before criminals do. Attackers enjoy unrestricted access to new offensive capabilities months ahead of anyone else, while defenders must rely on publicly available models or stolen corporate access.

The signatories are requesting five things from the AI labs: early access to the most capable models, sufficient computing power for meaningful reviews, secure environments to examine private code, eligibility for small and independent maintainers, and a direct line to lab security teams for reporting their findings. The timing is strategic, as two of the signatories recently demonstrated both the attackers' and defenders' positions.

BTCPay Server, a signatory, recently disclosed a critical flaw that attackers had already exploited, while Foundation, a hardware wallet maker, also signed the letter and experienced a similar attack on its node. BTCPay Server attributed the issue to AI's impact on the balance between attackers and defenders, stating that models expedite and lower the cost of searching large codebases for weaknesses.

The Bitcoin Red Team, a volunteer group, has been utilizing AI models on bitcoin codebases since this month, filing thousands of findings across hundreds of projects, including the BTCPay Server patch. Zcash's Tachyon upgrade aims to scale shielded payments, enhance quantum readiness, and assess the project's funding, security, and governance.