Bitcoin has spent 17 years surviving one of the most adversarial environments in software.
But Bitcoin Core isn’t where most users interact with Bitcoin.
They interact through wallets, hardware devices, Lightning implementations, libraries, exchanges, signing infrastructure and other software built around it.
Over the past few months, I’ve been researching the security of projects across this ecosystem, and the uncomfortable part isn’t that vulnerabilities exist. It’s how little continuous adversarial security research some important projects actually receive.
An audit is a snapshot. Open source doesn’t mean someone capable has actually reviewed the code. A large number of users doesn’t mean the project has been continuously attacked by security researchers.
And then there’s the incentive problem.
If reporting a vulnerability responsibly means hunting down a contact, waiting weeks for a response, receiving no bounty or recognition, and sometimes being treated as an inconvenience, eventually good researchers spend their time somewhere else.
Blackhats don’t need a disclosure policy.
That leaves us with a strange situation:
Bitcoin teaches us “don’t trust, verify,” while much of the software surrounding Bitcoin is trusted far more than it is independently verified.
I ended up writing a fairly detailed piece about what I’ve seen and why I think this is becoming a real problem.
I’m not linking it here because I’d rather this not turn into self-promotion.
But I’d genuinely like to know whether people working deeper in Bitcoin have noticed the same thing.
I have actually audited a grand total of zero projects. Not even pointed an LLM at them and told it to look for vulnerabilities or backdoors.
My excuse used to be that I wasn't a developer, so how was I suppose to audit the codebase of something like boltz or phoenix?
Instead, I "verified" by looking at what people I assumed were capable of such audits said. Notably, I did not check to see if they actually did audit any code.
This doesn't sound very cypherpunk does it?
Do you think there is less trust involved if a non-dev uses an LLM to perform some basic probing of the software they use or is that mostly an illusory sort of security?
(I'd be curious to read your piece about this if you care to link)
The gap you are pointing at is real, and it is probably the most underrated risk in Bitcoin.
Core gets the scrutiny because it is the thing everyone agrees matters. Wallets, Lightning implementations, signing libraries and the pile of JS around them get far less, even though that is exactly where a user's keys actually live. A hardware wallet with a hardened secure element still depends on the companion app, the USB stack, the firmware update path and a supply chain that most people never audit.
An audit being a snapshot is the key insight. It tells you the code looked reasonable on one date. It says nothing about the dependency that changed next week, or the maintainer who burnt out and handed a repo to someone who never cared that much. The projects that stay safe are the ones with a small list of dependencies and a smaller list of people who can merge, not the ones with the most badges.
So I would add one thing to your framing: the metric that matters is not "was this audited" but "how quickly does a real bug get found and fixed". That is the part continuous adversarial research actually improves, and the part most of the ecosystem still does not have.