AI Just Audited 390 Bitcoin Projects in 30 Hours. I Ran the Numbers on Its Claims.

Open the campaign report and one number stops you cold: 4,962 findings across 390 Bitcoin-related open source projects in 30 hours. That is roughly 165 findings per hour, or ten per researcher, per hour. The organizers called it a breakthrough. The headline wrote itself. But I have spent enough years in this industry to know that impressive output is not the same as verified truth. Back in 2017, while my classmates flipped ICO tokens, I spent twelve months auditing the whitepapers of over 150 projects, reading mission statements instead of price charts. That habit taught me something permanent: when numbers look too clean, the mess is usually underneath. So I did what any sober analyst should do. I cross-checked the arithmetic. What I found is a 35% gap between what was claimed and what the data actually supports, and that gap tells us more about the state of AI security auditing than the press release ever could. The campaign itself deserves serious respect. A developer named Calle assembled 16 security researchers for a concentrated assault on the open source code that supports the Bitcoin ecosystem. OpenSats, OpenCode, and AI inference sponsors provided backing. The methodology was refreshingly human-centered: researchers actively steered the AI systems, each participant using different prompts and different strategies, precisely because diverse approaches surface weaknesses that any single method would miss. This is ensemble learning applied to vulnerability hunting, and it is the smartest way to deploy AI in security right now. The serious findings were sent to affected project maintainers along with proof-of-concept re-test demonstrations. Many maintainers quickly confirmed the reports. That is a genuine positive signal, not a marketing artifact. But then the numbers started rubbing against each other. The article claims 720 severe or high-risk issues, which it translates to 2.3 such issues per researcher per hour. My arithmetic says otherwise. 720 divided by 16 researchers divided by 30 hours yields exactly 1.5 per person-hour. To reach the claimed 2.3, each researcher would have needed to be productively hunting for only about 19.6 hours of that 30-hour window. The discrepancy could mean the organizers measured only active working time, excluding coordination calls, rest, or the silent hours you spend staring at a codebase wondering if your prompt missed something. I know those hours well. Or it could be optimistic rounding. Either way, when a published metric is inflated by a third, I want to know what else in the announcement received the same polish. This matters far beyond scoring points on arithmetic. The campaign represents a genuine inflection point for how we secure open source infrastructure. Traditional audits of a single medium-sized project routinely consume one to four person-weeks of senior talent. Covering 390 projects in 30 hours is a step-change in throughput that no purely human workforce could match. The AI's semantic understanding of code, not just pattern-matching like older static analysis tools such as Slither or Mythril, but actual reasoning about logic, state, and control flow, is what makes this feasible. From my work mentoring developers after the 2022 crash, I have seen the difference between tooling that finds suspicious patterns and tooling that understands why a pattern is dangerous. This campaign leans on the latter. The deeper issue is the distinction between findings and vulnerabilities. Any large-scale automated scan, whether AI-powered or not, produces false positives. The real measure of success is confirmable, exploitable bugs that get fixed. Maintainer confirmation is the first positive signal, but we need the follow-through: how many findings became patches, how many were duplicates, how many were noise? The report does not tell us. In my experience building educational frameworks around security, raw defect counts are seductive but poor currency. What matters is whether the covenant between auditor and maintainer survives contact with reality. A finding that is acknowledged but never remediated is not a win. It is a lead. The ensemble approach deserves more attention than it received. Having 16 researchers use different prompts is clever, but it is also a workaround for a limitation: no single AI model or prompt yet captures the contextual knowledge and business-logic intuition that a seasoned auditor carries in their head. The researchers are manually diversifying the model's blind spots. That is not a weakness. It is the most honest use of AI available today. But it also means the model pipelines themselves need far more standardized evaluation. We do not know which models were used, what benchmark was applied, or how the 4,962 findings were triaged. That opacity would be unacceptable in a traditional audit report, and it should be unacceptable here. Here is the contrarian question nobody is asking: does this campaign actually threaten the traditional audit industry, or does it merely recreate it in compressed form? The headlines suggest AI is replacing humans. Look closer and you will see the opposite. Every one of those 4,962 findings needed human judgment to triage, verify, and translate into a coherent report for maintainers. The 30 hours was an upper bound on machine throughput, not on human oversight. Traditional firms might even benefit. Their real business is validation, and there is now a cheap tool that generates candidate findings at scale, feeding their review pipelines. The cost of initial discovery drops by an order of magnitude, but the cost of truth remains stubbornly human. My real worry is about incentive alignment. During the DeFi Summer of 2020, I watched teams optimize for total value locked and yield numbers while the human costs mounted quietly underneath. Campaigns like this risk the same trap: optimizing for findings per hour while broader questions of severity, exploitability, and long-term maintainer burden get swept aside. Bulls react to 4,962. Bears reflect on what 720 actually means. We build on the ones that get fixed. This campaign is a milestone, but milestones only count if the path continues beyond the press cycle. Verify the code, trust the community, and demand that the community publish the follow-up data. How many of those 4,962 findings became merged patches thirty days later? That is the number I want to see next. Tech changes. Values remain. In a bear market, rigor is the only yield that cannot be rehypothecated.