Changpeng Zhao, the Binance co-founder widely known as CZ, has pushed back against concern that artificial intelligence-assisted hacking poses an outsized danger to crypto networks. He argues the fears are overblown, pointing out that the internet and traditional banking operate on cryptographic foundations that are comparatively weaker than those securing most modern blockchains. His comments come amid a wider debate over whether AI tools materially shift the balance between attackers and defenders across digital finance. Zhao, who founded Binance in 2017 and stepped down as its chief executive in November 2023, remains one of crypto's most widely followed public commentators.

CZ's Case That the Fears Are Overblown

CZ's core position is that the threat model applied to crypto is inconsistently strict. He has argued that the broader digital economy, including the HTTP and TLS infrastructure of the public internet and the legacy encryption standards used in retail and interbank settlement systems, relies on security assumptions that are no more robust, and in many cases weaker, than the elliptic curve cryptography and hash functions that secure Bitcoin and comparable proof-of-work and proof-of-stake networks.

The argument follows a comparative logic: if AI-assisted adversaries were capable of breaking the cryptographic primitives protecting crypto wallets and on-chain transactions, those same capabilities would compromise online banking, payment card networks, and the authentication layers that protect e-commerce infrastructure first, since those systems carry larger aggregate value and have historically received less adversarial scrutiny from the research community.

What the Statement Does Not Prove

CZ's framing is a rebuttal to perception, not a technical audit. Pointing out that legacy banking infrastructure carries comparable or greater theoretical exposure does not mean crypto is immune to AI-augmented threats; it means the threat is not uniquely concentrated in crypto. The distinction matters for how users and protocols should calibrate their own risk assessment.

The claim also does not address application-layer vulnerabilities specific to DeFi: smart contract exploits, oracle manipulation, and governance attacks are not defeated by strong on-chain cryptography. As the Chainalysis-tracked Drift exploiter case illustrates — the 2024 attack on Drift Protocol, a Solana-based perpetuals exchange — fund movement and protocol exploitation regularly involve social engineering, key mismanagement, or contract logic errors rather than elliptic curve cryptography directly.

Why CZ Compares Crypto With Internet and Banking Security

The comparison CZ draws is grounded in the structure of public-key cryptography. Bitcoin's secp256k1 curve and SHA-256 hashing, Ethereum's keccak-256 implementation, and the consensus-layer signature schemes used by major proof-of-stake validators are all built on mathematical problems — elliptic curve discrete logarithm and preimage resistance — that are not meaningfully easier for current or near-term AI systems to break than the RSA-2048 and AES-128 standards underpinning most internet and banking authentication flows.

Where the comparison carries the most weight is in quantum threat discourse. The NIST post-quantum standardization process, finalized in August 2024, targets the same cryptographic primitives used across both crypto and conventional finance. If a sufficiently powerful quantum computer eventually threatened secp256k1, it would simultaneously threaten the TLS handshakes that protect every HTTPS banking session. CZ's point is that framing crypto as uniquely fragile misrepresents the shared nature of the underlying risk.

Why a Comparison Is Not a Guarantee of Safety

The "banking uses the same cryptography" argument works as a relative statement but not as an absolute assurance. Traditional finance benefits from reversibility, regulatory backstops, and fraud recovery infrastructure that on-chain settlement does not provide. A successful attack on a crypto private key results in an irreversible loss, while the same class of cryptographic failure in a banking context typically triggers fraud detection layers and potential chargebacks. The attack surface comparison is valid; the consequence comparison is not symmetric.

Protocol-level security also diverges sharply from key-custody security. The Bitcoin network's hash rate and Ethereum's validator set represent robust consensus-layer defenses, but the majority of theft from crypto users occurs at the custody layer: phishing attacks, compromised seed phrases, malicious browser extensions, and exchange-level breaches. The roughly $1.5 billion stolen from exchange Bybit in February 2025 — attributed by investigators to North Korea-linked hackers who compromised a wallet-signing interface rather than the underlying cryptography — showed the pattern at scale: the signature math held, and the custody workflow failed. AI tools have already lowered the cost of producing highly convincing phishing content and deepfake social engineering, a real and demonstrable expansion of the attack surface that does not require breaking any cryptographic primitive.

What the Debate Means for Crypto Security Expectations

Taken together, the argument holds that AI-driven crypto hacking fears are disproportionate because internet and banking infrastructure runs on comparable or weaker cryptographic foundations; that the comparison is valid at the protocol cryptography layer but does not extend to application-layer risks specific to DeFi, such as smart contract exploits and custody failures; and that AI's near-term threat to crypto is concentrated in social engineering and phishing rather than in breaking elliptic curve or hash primitives, which remain computationally infeasible to attack with current hardware.

Risk Perception Versus Demonstrated Incidents

The majority of documented large-scale crypto losses attributed to sophisticated attackers have involved compromised private keys, insider access, or smart contract logic errors rather than any form of cryptographic brute force. Chainalysis estimates that roughly $2.2 billion was stolen in crypto hacks across 2024, a total assembled from key compromises, code exploitation, and operational failures rather than broken encryption. AI capabilities available today meaningfully accelerate the social engineering component of these attacks, producing more convincing spear-phishing emails and fake support interactions, but they do not change the underlying mathematical security of on-chain transaction signing.

The distinction is operationally important for DeFi protocols managing concentrated liquidity positions, governance multisigs, and protocol-owned treasury allocations. The threat model for a Gnosis Safe multisig holding protocol reserves is primarily about signer key hygiene and governance process integrity, not about the elliptic curve math that protects the signatures themselves. CZ's framing is correct at one layer of the stack and less relevant at the layers where most DeFi losses actually occur.

What to Watch Next

The more consequential near-term development in AI and crypto security is not a cryptographic break but the acceleration of autonomous attack tooling: AI agents that can identify and probe vulnerable smart contract deployments at scale, or automate the social engineering steps needed to compromise a protocol's governance or operational security. These vectors do not require defeating SHA-256; they require only that human operators remain in the loop of key management and governance decisions, which is precisely where DeFi protocols remain most exposed. The counterweight to watch is whether defensive tooling absorbs the same automation at a comparable pace — on-chain monitoring and security-audit platforms already apply machine learning to anomaly detection and contract review.

For users assessing portfolio exposure, the relevant question is not whether AI can crack Bitcoin's cryptography, which is not a credible near-term threat, but whether the protocols and custodians holding their assets have hardened their operational security against the phishing, impersonation, and automated vulnerability scanning that AI tooling has made significantly cheaper and faster to execute.