In brief
- Vitalik Buterin rejected the idea that AI-powered hacking means cybersecurity is doomed.
- He argued that AI could make formal verification practical across entire software systems.
- The comments build on Ethereum’s push toward AI-assisted security, privacy, STARKs, and quantum resistance.
Ethereum co-founder Vitalik Buterin says AI does not spell the end of cybersecurity, arguing instead that advanced models could help make crypto software harder to break.
In a Wednesday post on X, Buterin argued that AI will not give hackers an insurmountable advantage, adding that crypto holders—including himself, with roughly 90% of his net worth in crypto—are betting that security defenses can keep pace.
“It’s an increasingly common take that AI hacking means cybersecurity is doomed,” Buterin wrote. “I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together.”
Buterin argued that AI could make formal verification—the use of mathematical proofs to establish that software is secure—practical even for complex systems.
“If AI can prove Navier-Stokes and FLT, then AI can prove the statement ‘this program is secure’ as a mathematical theorem,” he wrote. “Even if the program is very complicated.”
In other words, Buterin believes AI sophisticated enough to solve famously difficult mathematical problems could also prove that even complex software meets clearly defined security requirements.
That does not mean, however, that security is easy, he said. The hard part is defining what “secure” means in the first place.
Blockchain developers are increasingly using AI agents to scan code, test exploits, and verify bugs before attackers can act, with researchers uncovering vulnerabilities in both Ethereum infrastructure and Bitcoin software.
Developers across the crypto space are deploying AI defensively following several incidents that fueled fears that AI was giving attackers an advantage.
In May, security researcher Taylor Hornby used Anthropic’s Claude Opus 4.8 to uncover a four-year-old flaw in Zcash’s Orchard privacy pool that could have enabled unlimited, undetectable counterfeiting of ZEC, though developers found no evidence it had been exploited before they patched it in June.
The race between attackers and defenders accelerated in July, when Ethereum Foundation researchers said AI agents had uncovered vulnerabilities in critical network infrastructure. That same month, attackers began draining Coldcard wallets through a years-old firmware flaw that weakened seed generation, ultimately stealing roughly $130 million in Bitcoin. Coldcard maker Coinkite said AI likely helped identify the bug.
By August, the threat had spread across the Bitcoin software ecosystem. Boltz suspended its swap service, saying suspected attackers were finding flaws faster than its developers could fix them, while Core Lightning confirmed that several vulnerabilities identified in AI-generated reports were genuine. In response, the volunteer Bitcoin Red Team used AI-assisted audits to flag 4,962 potential vulnerabilities across 390 projects.
Buterin said AI can now verify entire programs rather than select components, an approach Ethereum plans to pursue over the next several years.
“There is no future for blockchains—especially blockchains with scalability and privacy—without doing this,” he said. “We need to make software actually secure. And we have already made a lot of progress.”