- Published on
Finding Vulnerabilities, Funding Defenders
- Authors
- Name
- Tuma
- @tuma
- Name
- OpenSats
Announcing OpenSats’ first round of grants supporting the current red-teaming efforts going on across the entire Bitcoin ecosystem.
In the wake of the numerous security incidents that recently hit the Bitcoin ecosystem – such as the Coldcard incident, the BTCPay Server exploit, Core Lightning vulnerabilities, and several others – OpenSats created a dedicated fund to reimburse the cost of AI tokens that developers and security researchers are incurring to find and disclose vulnerabilities in critical Bitcoin infrastructure.
The developers who were awarded the first set of grants are:
These grants are sourced from our Red Team Fund, which is supported by generous donors like you. If you would like to support red-teaming efforts for free and open-source projects that help Bitcoin flourish, consider donating to the fund:
Let's explore the work our new grantees have done to keep Bitcoin secure and how the grants will support their efforts in the future.
Rob Hamilton
Rob Hamilton is the CEO of AnchorWatch – a cold storage solution for individuals and businesses. As soon as the consequences of the Coldcard incident were beginning to unfold, he was one of the first developers in the ecosystem, together with a small group of open-source contributors, to start using LLMs to scan several Bitcoin-related projects looking for critical vulnerabilities.
Rob Hamilton and the rest of the team – which was later named “The Red Team” – were able to find and responsibly disclose around 8,000 vulnerabilities in less than a week, at the cost of tens of thousands of dollars in AI tokens, with costs growing rapidly due to the extensive use of those tools. They did so by leveraging the open-weight model Kimi K3 which, unlike its US counterparts, had no guardrails preventing its use in security-related tasks.
With support from this grant, Rob Hamilton will be able to cover the cost of those AI tokens that were needed to red-team a huge part of the Bitcoin ecosystem.
L0rinc
L0rinc is a full-time Bitcoin Core developer. He received a first grant from OpenSats in December 2024, which was later renewed in January 2025. During his years as a contributor, l0rinc authored around 150 pull requests (PRs) in Bitcoin Core and provided reviews to more than 400 PRs by other developers. His work focused on several topics, from testing to benchmarking, with a particular effort on optimizing the performance of Initial Block Download (IBD) and the memory usage across several parts of the codebase.
Since May 2026, l0rinc has been scanning both Bitcoin Core and libsecp256k1 using AI-assisted tools. He was able to discover several vulnerabilities, responsibly disclosing the issues to the maintainers and helping to fix them whenever possible.
With support from this grant, l0rinc will be able to continue his LLM-assisted security scanning of Bitcoin Core and libsecp256k1, focusing on code review, fuzzing, and scrutiny of security-critical assumptions, while also expanding his reach to other Bitcoin-related projects in case capacity allows. Funding will help l0rinc cover costs of AI APIs and tokens and servers to allow scanning to run continuously on the selected projects.
Knorrium
Knorrium is a software engineer from Brazil. With more than 20 years spent working in software development, he gained expertise in testing automations for mobile and web development. He has been contributing to mempool.space as a quality advisor for the last five years, focusing mainly on building end-to-end (E2E) testing and creating a continuous integration (CI) workflow – a way to run automatic software building and testing after each new development.
With support from this grant, knorrium plans to improve test coverage and build test vectors to inspect edge cases that could lead to potentially critical vulnerabilities and exploitable code in Bitcoin wallets and infrastructure. He is also planning to add those testing improvements to the GitHub CI workflows.
Lrifton92
Lrifton92 is a developer and open-source contributor who dedicated his efforts to red-teaming the Go Bitcoin stack, such as btcd, lnd, Neutrino, and the ecosystem running on this software stack. He leverages differential fuzzing, checking the Go codebases against Bitcoin Core and other reference implementations for discrepancies between them.
He has been focusing on a particular class of subtle bugs linked to decoding and parsing paths that silently accept malformed inputs. He was able to find several issues, such as a missing validation that led to acceptance of out-of-range private keys (btcd #2545), a bug bypassing BIP340 requirement for a Schnorr signature (btcd #2561), and a divergence from Bitcoin Core on how btcd parses and handles trailing bytes in PSBTs and in sendrawtransaction and decoderawtransaction RPC calls (all merged by btcd maintainers in #2558).
With support from this grant, Lrifton92 will focus on continuing his red-teaming efforts on all those downstream projects leveraging btcd, while also reviewing security relevant PRs for that project. Moreover, he will expand his differential testing suite to include validation of scripts and tapscripts and parsing of PSBTs and MuSig2.
Kukks
Kukks is CTO at ArkLabs – the company behind the Ark implementation Arkade – and is one of the most prolific contributors of BTCPay Server. He has been contributing to the Dotnet (.NET) Bitcoin ecosystem, providing his expertise to upstream dependencies, such as NBitcoin. He is currently working on building private, specialized agent harnesses to provide regular, fine-tuned, LLM-assisted security auditing to the projects he is working on.
With support from this grant, Kukks will work towards expanding his harnesses to the whole BTCPay Server stack, covering several libraries in the .NET Bitcoin ecosystem.
OpenSats remains committed to fostering the security of critical Bitcoin infrastructure. Our Red Team Fund applications are fast-tracked to enable security researchers to discover vulnerabilities in their projects before attackers do. AI token usage can rapidly soar, and this fund helps developers cover that cost.
We thank our donors who make these grants possible and invite others to join us in making the Bitcoin ecosystem more resilient. We encourage experienced developers to apply for funding, and we welcome everyone to support our mission.