A volunteer-led Bitcoin security effort said Moonshot AI’s Kimi K3 was used to scan 501 open-source Bitcoin projects over two weeks, producing 7,958 findings, with 1,280 rated high-risk or critical. The campaign was organized after a July 30 Coldcard firmware flaw was linked to losses of more than $100 million, with suspected total losses nearing $130 million. On Aug. 13, Bitcoin Red Team member and Cashu founder Calle said the exercise showed how quickly AI can surface long-buried weaknesses in mature codebases. The figures do not mean every issue has been confirmed. At the 108-hour mark, only 24.7% of findings had been dynamically reproduced and 29.4% had been reported to project maintainers, while human validation was still ongoing. Even so, the effort already produced at least one serious real-world case: BTCPay Server said a two-factor authentication bypass reported by Bruno Garcia and Ben Carman had been exploited before it was patched, allowing an attacker to obtain node admin credentials and take control of an attached Lightning wallet. The report also highlighted a policy split in AI access. Rob Hamilton of AnchorWatch said OpenAI blocked his attempt to analyze a publicly disclosed codebase after identity verification, while more than 70 custodians, exchanges, miners and developer groups signed an Aug. 10 public letter urging frontier AI labs to provide access to trusted defenders.

Zhipu, listed as 02513.HK, said on Aug. 14 that it has released GLM-5.3. The company said the new model uses the same base model as GLM-5.2, with all performance improvements coming from post-training optimization rather than changes to the underlying foundation. According to Zhipu, GLM-5.3 performs better than GLM-5.2 on complex coding and long-horizon tasks. The company also described it as the most capable open-weight model currently available in terms of functionality. In Zhipu’s internal Z.ai coding benchmark, GLM-5.3 posted a 50% performance improvement over GLM-5.2. Zhipu added that during large-scale deployment after training, the model’s network capability developed faster than expected. On the CyberGym platform, GLM-5.3 ranked at the front in vulnerability discovery, with the biggest gains showing up in the later stages of exploit chains. In exploit benchmark tests, its performance was more than double that of GLM-5.2. The company said it plans to publish the model weights two weeks after release, pending completion of safety evaluation and reinforcement work.

Z.ai, the developer behind the GLM family of models, has released GLM-5.3. According to the team, the new model is built on the same foundation model as GLM-5.2, with the performance delta coming from expanded post-training rather than a new base architecture. On internal coding evaluations, GLM-5.3 improves by 50% over GLM-5.2 on the Z.ai Code Bench. The model also reaches leading performance among open models on public benchmarks such as Terminal Bench 3 and Agents' Last Exam. In the security arena, GLM-5.3 achieved an 84.5% score on CyberGym's vulnerability discovery benchmark. It also shows significant gains on exploit-chain related tests, including ExploitBench and ExploitGym, compared with its predecessor. These results were reported by ChainCatcher, based on the official announcement from Z.ai. The announcement says the improvement comes from scaling up post-training while keeping the underlying foundation model unchanged. For GLM-5.3, the emphasis is on coding and security-related performance, both of which showed measurable gains in the cited benchmarks.

Z.ai, the developer behind the GLM model family, released GLM-5.3 on August 14, marking its latest model update. The new model shares the same base model as GLM-5.2, with performance gains attributed to an expanded post-training phase, according to the company. In its own Z.ai Code Bench coding benchmark, GLM-5.3 beat GLM-5.2 by 50%. On public evaluations that include Terminal Bench 3.0 and Agents' Last Exam, GLM-5.3 reached the leading tier among open-weight models. Cybersecurity results improved as well. The model scored 84.5% on CyberGym's vulnerability discovery benchmark and posted large gains on exploit-chain tests like ExploitBench and ExploitGym, compared with the earlier release. Z.ai said weights will open two weeks after the launch, with security assessment and hardening still in progress. On the API side, the model drops the option to disable thinking mode, replacing it with three reasoning intensity settings: low, high, and max.

Z.ai has teased the upcoming release of GLM-5.3, a model focused on programming and cyber-defense challenges. The company says GLM-5.3 is post-trained from a 743B-parameter base model, delivering top-tier coding and agentic abilities. Z.ai also reports notable progress in cybersecurity, positioning the model as a new standard for open-source AI.

According to LatePost, Zhipu’s MaaS open platform has nearly 7 million registered users, up by about 2 million from early July, with enterprise clients reaching 23,000. Its developer product ZCode passed 1 million users within a month of launch, while the company’s annual recurring revenue, or ARR, has grown about 15-fold this year, the report said. Market sources cited in the report said Zhipu’s current ARR may have reached $2 billion, though the company has not officially confirmed that figure. As model-calling demand rises, Zhipu has expanded its domestic computing base and has already activated more than 50,000 locally made AI compute chips to ease inference pressure. The report also said growth has been driven mainly by demand for coding-related use cases, with API services now becoming the company’s core source of revenue after the release of its GLM-5 model.

A years-old randomness flaw in Coldcard hardware wallet firmware has come under intense scrutiny after several waves of suspicious Bitcoin sweeps were linked by researchers to seeds created under affected software versions. Investigations by Block and Coinkite traced the issue to a 2021 code migration that routed seed generation through a software pseudorandom number generator instead of the intended hardware RNG on some firmware paths, reducing the effective search space of wallet seeds below the design target. Galaxy Research said three suspected attack waves it identified covered 4,585 addresses and 1,367.05 BTC, and on Aug. 3 its researchers flagged a fourth wave that was later updated to about 448.7 BTC across 709 potential victim addresses. Those figures come from on-chain pattern analysis and are not a wallet-by-wallet confirmation of Coldcard victims or final losses. The incident has also reopened debate over custody models. Researchers and market observers pointed to higher address activity, movements from older UTXOs, and inflows to centralized venues after the disclosure, while cautioning that on-chain data alone cannot prove those moves were caused by the Coldcard bug. Coinkite has said users with affected seeds need to generate a new seed in patched firmware or another trusted environment and move funds, because updating firmware alone does not restore the missing entropy in an already created mnemonic.

DeepSeek has restarted its second funding round, according to Caijing, which cited multiple trading sources familiar with the matter. The company is reportedly seeking RMB 50 billion in fresh capital at a pre-money valuation of about RMB 500 billion, with signing planned for late August. Caijing said the round had already been underway by mid-July before being abruptly paused near the end of the month. The report also revisited DeepSeek’s first financing round, which began in April and closed in June at RMB 50 billion, with a valuation above RMB 350 billion. Investors named in that round included the National AI Industry Investment Fund, Tencent, CATL, Puquan Capital, NetEase, JD.com, LISI Capital, IDG Capital, Zhengxingu Investment, and Shixiang Capital. According to one participant cited by the outlet, more than RMB 100 billion of capital had initially expressed interest, leaving at least RMB 50 billion still seeking exposure after only half that amount was allocated. Caijing added that the market is also watching model releases as closely as financing activity. It said DeepSeek-V4-Flash formally entered public beta on July 31 and later posted a score of 50 on Artificial Analysis’ latest Intelligence Index, trailing only Zhipu’s GLM-5.2 at 51 in China. On pricing, the report said V4-Flash charges $0.28 per million output tokens, compared with $4.29 for GLM-5.2.