AI is getting horrifyingly good at finding bugs, and crypto is starting to reorganize around that fact.
Just look at the OG chain this week. On Thursday (Oct. 22nd), Bitcoin Core merged a security policy change for bugs “that can be found with a simple prompt to an LLM.” Instead of sitting under embargo for up to a year, those vectors now get fixed and shipped ASAP. As the change’s author, Antoine Poinsot, put it, LLMs are “drastically reducing the bar to find certain classes of issues.”
Meanwhile, two critical PHP flaws found with help from AI models left ~1.3M internet-exposed hosts vulnerable. Then today, Initia halted its entire network after an attacker exploited what cofounder Zon called a “Day 0 bug” to mint tokens and bridge out ~$2.7M. There’s no confirmation yet that AI was used for this hack, yet it seems safe to assume it was in some capacity.
DefiLlama’s hacks database, which I dug into for my data markets piece this week, now logs 112 +$1M hacks so far in 2026, versus 70 in all of 2025. And Anthropic’s smart contract research found frontier models’ simulated exploit revenue doubling roughly every 1.3 months in 2025.
So what do you do when attackers have tireless, constantly improving bug hunters on tap? Crypto is converging on two very different answers.
The first answer is to stay nimble, i.e. keep the ability to patch or stop things quickly.
Starknet is the clearest example of this philosophy today. On Thursday, its community voted to research becoming an independent post-quantum L1, partly so it can upgrade its cryptography on its own schedule. As StarkWare put it, “we can’t depend on Ethereum moving fast enough to ensure our safety.” CEO Eli Ben-Sasson now pegs quantum’s arrival at “2 years,” arguing AI is speeding up the timeline.
— (@)
Ethereum researchers are on alert, too. Earlier this month, Justin Drake urged the industry to plan for “bunker mode,” i.e. moving funds to fresh, safer addresses, after a wave of AI-driven math breakthroughs.
In fairness, though, agility has a cost. Every admin key and upgrade path is also something to attack or depend on. And changing the rules can create bugs of its own, which is why Ethereum pulled Glamsterdam from its Hoodi testnet this week over research showing its gas changes could alter how deployed contracts behave.
The second answer is to shrink the target. Here’s how Ethereum developer Ross (z0r0z) framed it on Thursday:
Enjoying this article?
Subscribe to Bankless or sign in
— (@)
That’s a little ambitious, sure. Yet the idea is basically an expression of Ross’s walkaway test philosophy, i.e. can a system keep working safely even if its builders disappear tomorrow? Small, deterministic code that anyone can verify leaves fewer places to break and fewer parties to trust. As Ross added in a reply, “Dev has to focus on simpler code.”
The same instinct shows up in Ethereum cryptography, where Vitalik says Ethereum’s roadmap has gone “hash-only” partly because hashes are designed to have no exploitable structure for AI-accelerated math to crack.
Of course, there’s a flip side. Public, immutable code is readable by AI attackers too, and you can’t patch it once it’s live. So minimalism works best if the code is small enough to check exhaustively.
That’s where formal verification, i.e. mathematically proving code can’t break certain rules, gets compelling.
Historically, this approach has been brutally expensive. The seL4 OS kernel took two person-years to build but 20 to formally verify. Yet in new research with Theorem published Thursday, Anthropic used Claude to prove that 239 entry points across 123 open-source libraries can’t crash on any input up to 64 MB (under certain assumptions), and it did so in a few weeks.
— (@)
The catch? Proofs scale with code. A typical proof in the effort above ran ~600,000 lines for a program of ~18,000 machine instructions, so the work can eat hundreds of millions of AI tokens. Plus, a proof only covers the properties you specify rather than every possible bug.
However, notice who benefits most from cheaper proofs, namely small, single-purpose code, i.e. the exact kind of code that minimalists want to put onchain. If AI keeps driving proof costs down, “unpatchable” will matter less as code increasingly shouldn’t need patching.
Of course, agility will still matter for big, evolving systems like L1s and rollups. Still, in this new AI paradigm the walkaway test is looking more like a security north star and less like a mere decentralization ideal. Keep an eye on these trends accordingly.
