An IBM Researcher Anticipates Which Part of the Bitcoin Ecosystem Would Be Most Vulnerable

• The Mythos-class AI would increase risks in Bitcoin services without compromising the protocol.
• Wallets, Lightning, exchanges, and pools would be the main targets of an advanced AI.

The recent cases of Coldcard and Boltz have something in common: neither compromised the Bitcoin protocol, but rather services built on top of it. In the case of Coldcard, the issue was related to the firmware and the entropy generation mechanism of the hardware wallet, while Boltz faced an incident that affected the infrastructure of its service. This is precisely the scenario that cryptography and cybersecurity researcher Rob Campbell described months ago in a study on the impact of a new generation of artificial intelligence (AI) on distributed ledger networks.

In May 2026, the former IBM executive stated that an AI with advanced offensive capabilities would have little chance of compromising the Bitcoin protocol. However, he warned that the real risk would lie in the infrastructure that enables its daily operation: wallets, Lightning Network, exchanges, and mining software.

His conclusion was that a new generation of artificial intelligence models could modify the security of the Bitcoin ecosystem, although not necessarily by attacking its base protocol, but rather the layer of products, services, and infrastructure that operates on top of it.

In section 4.1, titled Bitcoin: Bounded Exposure, Campbell argues that the design of Bitcoin naturally limits opportunities for an AI to discover and exploit critical vulnerabilities.

The researcher attributes this resilience to the use of a non-Turing complete programming language, a reduced attack surface, over fifteen years of continuous review, and an extremely conservative evolution of consensus. Together, these elements leave little room for an AI to find flaws directly in the rules that sustain the network.

For Campbell, even advanced capabilities such as autonomous vulnerability discovery, chaining exploits, or agentic execution of attacks would have a limited impact on the main Bitcoin protocol. The recent episodes of Coldcard and Boltz illustrate this difference: the incidents did not affect Bitcoin's consensus but rather components of the ecosystem that operate on the network.

The landscape changes when analyzing the infrastructure built around Bitcoin. According to the researcher, the greatest exposure is concentrated in the implementations of software and hardware wallets, the firmware of these devices, the logic of the Lightning Network, integrations with exchanges, and the software used by mining pools.

Unlike the base protocol, these systems contain much more code, numerous integrations, and significantly higher complexity. This combination makes them more attractive targets for an AI capable of detecting vulnerabilities automatically. The case of Coldcard, for example, once again highlighted the firmware and entropy generation in a hardware wallet, while Boltz demonstrated that the infrastructure of services built around Bitcoin can also become a critical security point.

Therefore, Campbell concludes that a Mythos-class AI modestly raises the baseline risk without changing Bitcoin's strategic profile. In other words, the fundamental security of the network would remain virtually intact, but the probability of successful attacks against the services that are part of its ecosystem would increase.

According to the study, this type of AI would be capable of discovering vulnerabilities on a large scale, chaining multiple exploits, executing attacks autonomously, developing offensive tools in less than a day, and adapting to different types of infrastructures.

The most marked difference in the analysis appears in the comparison with Ethereum and its Layer 2 solutions (L2). Campbell argues that Bitcoin's exposure remains limited and concentrated in the ecosystem's infrastructure, where traditional cybersecurity measures ---such as audits, monitoring, and updates--- still retain effectiveness.

In contrast, he argues that Ethereum presents a structurally greater exposure due to the wide programmable surface of its smart contracts, decentralized applications, and cross-chain bridges.