Ethereum co-founder Vitalik Buterin has challenged the increasingly common view that AI-powered hackers will make cybersecurity impossible to defend, arguing that advanced verification tools could eventually give defenders a structural advantage. In a September 17 post on X, Buterin said he disagrees with the claim that “AI hacking means cybersecurity is doomed.”
He added that anyone still holding cryptocurrency is implicitly betting that secure digital systems can survive stronger automated attacks, and he revealed that roughly 90% of his own net worth remains in crypto. His argument focuses on formal verification, a technique that uses mathematical specifications and proofs to determine whether software behaves according to predefined properties. Buterin likened the approach to advanced mathematical theorem proving, suggesting sufficiently capable AI could help prove that “this program is secure” even when the software itself is complex.
Buterin cautioned that defining security too narrowly can leave attack paths in protocols, servers, databases, networking layers, caches, or supporting components. He said the goal should be to verify more of the complete system rather than labeling only a small group of modules as security-critical.
Ethereum is already testing AI-assisted security. The Ethereum Foundation Protocol Security team reported in July that coordinated AI agents had found real defects in systems used by Ethereum. One confirmed finding involved a remotely reachable crash in Rust libp2p’s Gossipsub networking implementation, later assigned CVE-2026-34219. Versions before 0.49.4 could be crashed remotely through a crafted PRUNE message that triggered an arithmetic overflow during Gossipsub backoff handling; version 0.49.4 fixed the issue.
The Foundation said vulnerability discovery was not the hardest part of the AI workflow. AI agents frequently generated convincing reports involving unreachable execution paths, debug-only failures, or formal proofs that passed while proving a weaker property than intended. Independent reproduction and human review remained required before a finding was accepted.
Formal verification is now part of Ethereum’s protocol roadmap. In its September 7 protocol priorities update, the Foundation said formal verification would serve as cross-cutting tooling across its remaining multi-year research areas through 2029, covering privacy, state, zkEVM development, post-quantum security, and other protocol components. A separate project launched in August, better.codes, combines AI agents with machine-checked proofs in Lean. The Foundation’s Q2 funding report also lists work on ETHeorem, SPECA, LeanAgent, and formal verification involving RISC-V zkVM infrastructure.
Buterin’s latest comments continue an existing research direction rather than announcing a new upgrade or scheduled fork. He did not name a new EIP, deployment date, or mandatory rule requiring every Ethereum program to undergo formal verification.
Recent evidence also shows AI is strengthening offensive cyber capability. Anthropic said in its September threat intelligence report that malicious actors were using AI to automate vulnerability research, exploit development, and multi-target campaigns. By August 26, the company had disclosed 2,300 AI-discovered vulnerabilities across 392 open-source projects, with 421 patched upstream. Anthropic has also described the same technology as useful for defense through its Project Glasswing initiative.
Buterin has previously rejected a separate argument that AI-driven security risks could severely damage confidence in Bitcoin. He said network-layer problems could often be addressed through software and mining-infrastructure upgrades, while actual breaks of Bitcoin’s hashes or proof-of-work mechanism are highly unlikely.
The comments arrive amid mixed crypto market signals and little immediate price action in Ethereum, shifting attention to security implications rather than short-term trading.
