AI Audited 390 Bitcoin Projects in 30 Hours. The Math Doesn't Add Up.

4,962 findings. 30 hours. 390 projects. 16 researchers. That's the official output of the AI-assisted Bitcoin security campaign led by developer Calle, backed by OpenSats, OpenCode, and AI inference sponsors. Fast. Headline-grade. The kind of throughput that should make traditional audit firms sweat. Then I ran the arithmetic. 4,962 findings divided by 30 hours equals 165.4 findings per hour. The campaign calls it 166. Fine. But the second headline metric — 720 severe or high-severity issues — divided across 16 researchers and 30 hours gives 1.5 severe issues per person-hour. The campaign claims 2.3. That's a 35% overstatement. Not a rounding error. A statistical confession. Either not all researchers worked all hours, or the AI pre-filtered the noise before the humans saw it. Either way, the published productivity number is inflated by roughly a third. And in security, inflated metrics are a red flag I was trained to chase. Anchor the facts. The campaign was a coordinated human-machine audit of 390 Bitcoin-related open-source projects. Sixteen security researchers, each using different prompts and methodologies to steer AI systems, spent 30 hours hunting vulnerabilities. The design premise: diverse prompting strategies catch weaknesses a single method misses. That premise is sound. It's ensemble learning applied to code security — multiple imperfect models, varied inputs, higher recall on edge-case faults. I've seen the same logic in market surveillance: no single anomaly detector catches layering, spoofing, and wash trading at once. You need overlapping detection surfaces, each with a different blind spot. Here's what the coverage misses. The campaign sent proof-of-concept retest demonstrations to project maintainers. Many maintainers rapidly confirmed the reports. That's real. It's the difference between a static analyzer's theoretical warning and a human-verified exploit path. But the methodology disclosure stops there. No specific AI models. No evaluation benchmarks. No code analysis stack. No follow-up data on how many of the 4,962 findings survived human verification. For a movement positioning itself as the scalable answer to crypto's audit crisis, that is a remarkably thin audit trail. Now the part that matters — unit economics. Traditional security audits: a mid-sized project typically demands one to four analyst-weeks. Apply that to 390 projects and you're looking at multi-year timelines and seven-figure budgets. This campaign compressed that scope into 30 hours. The implication isn't incremental. It's structural. If human-guided AI auditing sustains even 10% of this throughput after false-positive filtering, the cost of baseline security verification drops by one to two orders of magnitude. That's not an upgrade to the audit industry. That's a replacement threat. But the trade-off is measurable. Breadth versus depth is a permanent tension in forensic work. A 30-hour sweep across 390 repositories produces enormous recall and poor precision. It's a fine-mesh net — it catches everything and keeps almost nothing. The open question is whether the top of the funnel, those 720 severe/high items, converts into confirmed exploitable vulnerabilities at a rate that justifies the method. The maintainers' rapid confirmations are encouraging. But confirming a report is not confirming exploitation. My audit experience tells me the only metric that matters is "confirmed exploitable after PoC validation." The release gives us raw findings. The real signal — patch rate, fix turnaround time, re-audit results — only surfaces in the coming quarters. That's where the eyes should go. Also, consider the false-positive economics. 4,962 findings across 390 projects means roughly 12.7 findings per project. Even at a 90% false-positive rate — generous for AI-assisted scanning — that's over 1,200 maintainer action items. Most open-source maintainers work unpaid. The campaign moved the triage burden onto the very people it claims to help. That's a hidden cost no headline captures. Now the unreported angle. The campaign's biggest risk isn't false positives. It's false confidence. Markets don't crash because of visible risk; they crash because invisible risk got repriced as safe. Same logic here. A headline saying "4,962 issues found in 390 Bitcoin projects" creates a comforting illusion — that AI-augmented auditing has Bitcoin's back covered. It doesn't. Those 390 projects are open-source infrastructure. The unexamined surface is far larger: closed-source tooling, off-chain coordination layers, and the human operators holding keys. More critically, the AI's known blind spot is complex business-logic flaws. LLMs excel at pattern recognition and fail at multi-step stateful reasoning. The vulnerabilities that actually drain funds — the ones requiring governance, incentive, and economic context — slip through semantic analysis the same way they slip through static analyzers. Liquidity doesn't vanish from blockchains; it vanishes from trust. And trust in AI-audited code is a new counterparty risk. The market prices counterparty risk eventually. It always does. The next data point isn't the finding count. It's the patch rate. Watch whether maintainers actually fix the confirmed PoC issues, and how fast. Watch whether this audit model generates recurring revenue or remains a sponsored one-off. Watch the traditional audit firms — their response to a projected 100x cost compression tells you how seriously they take the threat. Arbitrage is the market's immune system. The arbitrage here is between the cost of perceived security and the cost of actual security. That gap just narrowed — but for whom? The honest answer determines whether this campaign becomes a turning point or a footnote. The exploit market is reading the same numbers. Speed wins. Alpha decays in milliseconds.