Bitcoin’s Complexity Problem Puts Layer-2 Scaling Projects in AI’s Crosshairs

Recent security incidents involving Coldcard, Core Lightning and Liquid Network are exposing a new reality for Bitcoin developers: artificial intelligence is making it easier and cheaper to uncover vulnerabilities buried in complex code.

The Bitcoin ecosystem has faced several high-profile security issues in recent months. The incidents have intensified concerns that AI-powered tools could dramatically reduce the resources needed to identify weaknesses in financial software that might otherwise remain undiscovered for years.

An attack on Coldcard wallets recently resulted in roughly $114 million worth of bitcoin (BTC) being drained. Core Lightning developers also responded to legitimate security flaws identified through AI-assisted research by issuing an emergency warning. In the latest incident, white-hat hackers exploited a vulnerability in Blockstream’s Liquid Network, withdrawing about 4,000 BTC, worth approximately $317 million. They subsequently returned 3,400 BTC after the vulnerability was fixed.

The incidents underscore a fundamental tension in Bitcoin’s development. The network’s core layer has deliberately favored simplicity as a way to limit potential security risks. But efforts to add functionality and improve transaction speeds through smart contracts and off-chain scaling solutions have created increasingly complicated layers of code, potentially expanding the attack surface.

AI is further changing that equation by allowing security researchers to examine enormous amounts of code in a short period. In August, a group of 16 Bitcoin developers used AI models to scan 390 Bitcoin projects. The effort generated nearly 5,000 potential findings, including 85 that were initially considered critical.

“At some point we have to admit it. AI is finding bugs that no human can find,” Gregory said in a Telegram message.

Gregory, a Bitcoin application developer, previously worked at Merrill Lynch and JPMorgan before co-founding CommerceBlock, where he became CEO. He has contributed to Bitcoin-related projects including MainStay and the statechain technology used by Mercury Wallet and Mercury Layer.

Mercury Layer is no longer operating, but its open-source code remains accessible on GitHub. According to Gregory, AI has fundamentally changed the security equation for older financial software because previously neglected code can now be examined quickly and inexpensively.

“If a model can wake a bug in finance C from 2006, it can probably read a statechain repo that has not moved,” he said.

That raises concerns over whether Mercury’s legacy code could contain vulnerabilities that were never discovered. Gregory identified areas such as key-share deletion, client-side transfer checks, backup transactions and the shrinking locktime mechanism as potential points that deserve additional examination.

“That is the new paradigm,” Gregory said. “Unused code stopped being unused the moment the cost of reading it dropped to zero.”