What Bitcoin Did · Oct 20, 2026 · 1h 32m · 85m saved
With Rob Hamilton, CEO and co-founder of AnchorWatch
A one-dollar AI scan found the firmware bug that a mass sweep of untouched Bitcoin exploited on the night of July 29. Years of professional audits had missed it. Rob Hamilton, CEO and co-founder of AnchorWatch, told Danny Knowles on What Bitcoin Did that the model that caught it wasn't Claude or OpenAI's — both refused to help.
"I loaded up Claude, instant downgrade to Opus... it wouldn't even talk to me. Then I loaded up Kimi K2 and I spent a dollar and I got the full answer in like three, five minutes."
Rob runs AnchorWatch, a Bitcoin self-custody insurance company, and within a day of the hack he had assembled the volunteer Bitcoin Red Team that went on to scan roughly 650 codebases across the ecosystem.
The full interview is covered here so you can skip it. 1 hour 32 minutes of audio, 7 minutes of reading.
Here are the 6 takeaways that matter.
Key Takeaways
A $1 scan on the open-weight Kimi K2 found the Coldcard firmware bug in minutes after Claude and OpenAI's models refused to engage
The volunteer Bitcoin Red Team scanned about 650 codebases, logged over 10,000 findings, and rated 1,500 of them critical or high
Bitcoin Core and its signature library held; the team spent $20,000–$25,000 stress-testing it and found it resilient — the bug was Coldcard's alone
His advice on self-custody risk: whatever dollar figure feels like enough to migrate off a single point of failure, cut it in half
A security review that used to cost $25,000–$50,000 and two to three weeks can now be approximated for $25 to $1,000 in AI compute
He calls the push to restrict open-weight AI models the bigger story than the hack itself, and compares it to 1990s fights over cryptography
1. The $1 AI Scan
Rob walked through the night of July 29–30, when a firmware bug in the Coldcard hardware wallet led to a mass sweep of Bitcoin that had sat untouched for years. He said the first attacker alone moved more than $100 million in the initial hours. When he tried to get a frontier model to analyze the firmware for the exploit, both Claude and OpenAI's models refused.
Claude and OpenAI's models wouldn't engage with the firmware; an open-weight model solved it in minutes for a dollar
"I loaded up Claude, instant downgrade to Opus... it wouldn't even talk to me. Then I loaded up Kimi K2 and I spent a dollar and I got the full answer in like three, five minutes." — Rob Hamilton
He argues frontier labs are quietly suppressing cybersecurity capability, partly to limit misuse and partly to stop competitors from copying their reasoning by watching it work.
Asking a frontier model to show its reasoning on a sensitive query gets the query blocked
"If you say 'show your work, I want to see your reasoning,' that will block you — because that's how you distill." — Rob Hamilton
