Ethereum co-founder Vitalik Buterin has rejected the notion that AI-powered hacking spells the end of cybersecurity, arguing instead that advanced models could make crypto software harder to break rather than easier.

In a Wednesday post on X, Buterin contended that AI will not hand hackers an insurmountable advantage, noting that crypto holders—including himself, with roughly 90% of his net worth held in crypto—are effectively betting that defensive security can keep pace with offensive capabilities.

"It's an increasingly common take that AI hacking means cybersecurity is doomed," Buterin wrote. "I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together."

Formal Verification at Scale

Central to Buterin's argument is the idea that AI could make formal verification—the use of mathematical proofs to establish that software behaves securely—practical even for highly complex systems. "If AI can prove Navier-Stokes and FLT, then AI can prove the statement 'this program is secure' as a mathematical theorem," he wrote. "Even if the program is very complicated."

In other words, Buterin believes AI models capable of solving famously difficult mathematical problems could also demonstrate that intricate software satisfies clearly defined security requirements. That does not mean security is easy, he cautioned; the hard part lies in defining what "secure" means in the first place.

The distinction matters because a completed proof rules out every behavior outside a program's specification, while audits and testing can only probe weaknesses reviewers know to look for—one reason formal methods have historically been reserved for small, critical components.

His remarks build on Ethereum's broader push toward AI-assisted security, privacy, STARKs—succinct cryptographic proofs that let computations be verified without revealing the data behind them—and quantum resistance.

An AI-Driven Arms Race

Blockchain developers are increasingly deploying AI agents to scan code, test exploits, and verify bugs before attackers can act, with researchers uncovering vulnerabilities in both Ethereum infrastructure and Bitcoin software. The defensive shift follows a string of incidents that fueled fears AI was tilting the field toward attackers.

In May, security researcher Taylor Hornby used Anthropic's Claude Opus 4.8 to uncover a four-year-old flaw in Zcash's Orchard privacy pool—one that could have enabled unlimited, undetectable counterfeiting of ZEC. Developers found no evidence it had been exploited and patched it in June.

The race between attackers and defenders intensified in July, when Ethereum Foundation researchers said AI agents had uncovered vulnerabilities in critical network infrastructure. That same month, attackers began draining Coldcard wallets through a years-old firmware flaw that weakened seed generation, ultimately stealing roughly $130 million in Bitcoin. Coinkite, the maker of Coldcard, said AI likely helped identify the bug.

By August, the threat had spread across the wider Bitcoin software ecosystem. Swap service Boltz suspended operations, saying suspected attackers were finding flaws faster than its developers could fix them, while Core Lightning confirmed that several vulnerabilities identified in AI-generated reports were genuine. In response, the volunteer Bitcoin Red Team conducted AI-assisted audits that flagged 4,962 potential vulnerabilities across 390 projects.

Entire Programs, Not Components

Buterin said AI can now verify entire programs rather than select components—an approach Ethereum plans to pursue over the next several years.

"There is no future for blockchains—especially blockchains with scalability and privacy—without doing this," he said. "We need to make software actually secure. And we have already made a lot of progress."

How far Ethereum gets on that multi-year roadmap—and whether ecosystem-wide AI audits continue to surface vulnerabilities at scale—will offer the clearest near-term gauge of the defense-favoring balance he describes.