The product lands weeks after what TRM Labs describes as the year's largest hardware wallet exploit: on July 30, an attacker drained more than $116 million in bitcoin from over 5,200 Coldcard wallets in four waves over a single week. The root cause was a firmware regression introduced in March 2021, in which a build-time check meant to force the hardware random number generator silently fell back to a deterministic software PRNG. Every seed became predictable. Human reviewers missed it for five years. An automated attacker did not.
That is the failure mode CyberScan is being positioned against, and the framing is worth dissecting.
The audit layer that sits between formal reviews
CyberScan is not a replacement for a human auditor. It is a continuous layer that runs as code evolves, mapping the repository, walking potential attack paths, and returning structured findings with severity ratings and file-level references. Three design choices matter more than the marketing.
Runs are resumable. If a scan is interrupted, the state is preserved, and live progress plus token usage remain visible so teams can monitor cost in real time. The integration surface is exposed through an API and through the Model Context Protocol, so findings can flow into the same GitHub code-scanning alerts and issues that developers already triage. And teams select which model runs each scan, rather than inheriting a fixed provider.
Early access during the beta went to ArkLabs and Breez, both of which ran CyberScan against production code ahead of launch. Breez co-founder and CEO Roy Sheinfeld noted that Bitcoin infrastructure demands this level of rigor. ArkLabs CEO Marco Argentieri confirmed that every release now goes through CyberScan and that the code never leaves the team's own control.
The conditions that actually matter
If you operate trading infrastructure on top of open-source Bitcoin code, a continuous scanner only changes your threat model if three conditions hold.
The harness must preserve state across long reviews. Otherwise you get the same fragmentary output you would get from pasting a repo into a chat window, and the most subtle findings — exactly the ones that linger for years — are the ones that get lost. Findings have to land in the systems your developers already use, or they will sit unread in a dashboard nobody watches. And model selection has to stay under your control, because routing your full repository through a third-party scanner means trusting their sandbox with your counterparty logic.
In the two weeks following the Coldcard exploit, Prem AI reports serving more than 50 companies and processing more than 10 billion tokens, nearly all of it security research. Three critical vulnerabilities surfaced from that work and were disclosed and remediated in coordination with the affected maintainers.
That last detail is the one worth sitting with. The vulnerabilities were not exotic. They were the kind a careful reviewer could in principle catch, given enough time and the right checklist. The problem is that no team has the time to run a full audit on every commit, and the things that quietly rot in a codebase are exactly the things no one is looking at.
Run the audit on the code your trading bot actually depends on. If you cannot point to where the build-time checks live and when they were last reviewed, treat that as an active counterparty risk until proven otherwise.