RedTeam
SN61Competitive cybersecurity challenges where hackers and defenders compete to find exploits
A subnet where the miner output is shipped as production bot-defense code for real internet companies, and a slice of the resulting client revenue gets recycled into weekly TAO buybacks. Innerworks runs the subnet, and the work is in active production.
// Hackers competing to secure the internet.
RedTeam is a cybersecurity subnet run by Innerworks. Miners write code that solves concrete security challenges, the best submissions are deployed in real defensive products, and the team publishes weekly client buybacks of TAO funded by those products. The current focus is bot detection, device fingerprinting, and VPN detection.
The simple version: Imagine a continuous open competition for "build the best bot detector," where the winning solutions get plugged straight into the security stack of large web platforms. Whoever ships the most original useful code earns.
Centralized equivalent: Comparable to Cloudflare's bot management, DataDome, PerimeterX, or HUMAN Security, but the detection logic is written by an open miner pool against scored challenges rather than a single in-house team.
How it works:
- Miners submit code solutions to specific security challenges (currently including the FlowRadar VPN Detection challenge and a device-fingerprinting challenge). Submissions are checked against past entries for originality, scored daily, and the score decays over roughly 14 days so miners have to keep improving.
- Validators run the submissions against the challenge harness, score quality and uniqueness, and direct weights with a 50/50 split: half to challenge scores, half to alpha burn to manage subnet inflation.
- The problem it solves: Bot traffic accounts for a very large share of all web traffic, and defending against it requires constantly evolving detection logic. Most defenders maintain a small in-house team. RedTeam tries to offload that work to a continuous open pool.
- The opportunity: The cybersecurity defense market is in the hundreds of billions of dollars annually. Even a small share of bot-defense spend captured through an open subnet would be a meaningful flywheel for TAO.
- The Bittensor advantage: Decay plus originality scoring forces continuous innovation in a domain where stale defenses get bypassed quickly. Centralized vendors retrain models on their own cadence. RedTeam re-prices solutions every day.
- Traction signals: The Innerworks team account (
@_redteam_) publicly reports passing 11 weeks of subnet token buybacks funded by client revenue, with subnet outputs claimed to be deployed across over 125 million daily active users (notably as bot defense for 1inch). The GitHub repo shows steady commits to challenge images and validator state through May 2026, with version 4.6.4 released two days ago.
Category: Deepfake Detection and Security | Centralized Competitor: Cloudflare Bot Management, DataDome, HUMAN Security, PerimeterX
RedTeam is one of the relatively few Bittensor subnets where there is a clear, documented revenue path between the work miners produce and a real product. Innerworks (innerworks.me) sells bot defense, fingerprinting, and VPN detection as a security service, the underlying detection logic is sourced from RedTeam miner submissions, and a portion of the resulting revenue is used to buy TAO and burn or recycle it through the subnet alpha.
Mechanism:
There are three moving parts in the scoring system, all visible in the public README. First, every miner submission is checked against past accepted solutions for originality. Copies and trivial variants are rejected. Second, accepted submissions get a daily quality score against the challenge harness (currently FlowRadar VPN Detection and a device-fingerprinting challenge are the live tracks), and that score decays over roughly 14 days so miners are forced to keep iterating to stay paid. Third, validator weights are split 50/50 between challenge scores and alpha burn. The 50% burn is a deliberate inflation-control lever that the team has said will be adjusted once subnet alpha is at a stronger price.
The on-chain emission_miner_burn value is 50.01%, which lines up with the README's stated split. That is a high burn share compared to most subnets, and it is the main reason miner-side payouts on RedTeam look modest relative to the team's revenue numbers.
Development is genuinely active. The repository has 1,492 commits across 29 contributors. The last push was on 2026-05-25, and the most recent merges include the 4.6.4 release, new state-view methods for scoring and comparison logs, and an updated FlowRadar challenge image. The lead contributor accounts for roughly a quarter of total commits but is supported by a broad bench of regular committers, which is unusual at this scale.
Market and on-chain context: the alpha trades at 0.00402 TAO with a 21,018 TAO market cap and 7,786 TAO of root liquidity in the pool. The current emission share is 0% under the Taoflow model, which reflects net negative TAO flow over the smoothing window (approximately negative 137 TAO over the last seven days). The 30-day price is roughly flat at +1.5%, the 7-day window is down about 4%, and the 90-day window is down about 10%. TaoSwap currently shows 3 active miners, which is low for a subnet with 29 contributors and an actively iterating challenge stack.
The interesting tension on RedTeam is product success against token weakness. The team is shipping releases, publishing buyback updates, and citing concrete enterprise integrations, while the alpha token is in a quiet drawdown and current emission share is zero. Whether the buyback cadence eventually pulls net flows positive is the open question.
- Zero current emission share: Under Taoflow, the negative net flow window has pushed emission share to 0%. Until net flows turn positive, no new TAO is flowing into the subnet pool from the protocol, and miner-side payouts depend on the existing alpha pool only.
- High alpha burn lever: With 50% of validator weight directed to burn, miners earn from the remaining 50%. The team has flagged this as adjustable once subnet alpha strengthens, but for now it caps the miner-side incentive.
- Active miner count is low: TaoSwap currently reports 3 active miners. For a subnet that depends on continuous original code submissions, a thin miner pool is a meaningful risk to the quality and diversity of solutions.
- Customer concentration: Public team messaging emphasizes one large client integration. If that integration churns or the buyback program pauses, the "real revenue" narrative around the subnet weakens quickly.
- Mechanism dependence on challenge design: Because scoring decays and rewards originality, the design of each challenge matters a lot. A weak or game-able challenge could reward shallow submissions before being patched.
- Pool depth and slippage: 7,786 TAO of root liquidity is thin relative to the 21,018 TAO market cap, so larger position changes will move price meaningfully.
Another subnet, unpacked.
