AI Reduces Vulnerability Discovery Costs, Crypto Industry Divided in Response

The crypto space is splitting into two security paths: agile patching and minimal immutable approaches.

Written by: @Bankless

Compiled by: AididiaoJP, Foresight News

The ability of AI to find vulnerabilities has become so strong that the crypto industry must reorganize its security strategies.

First, let's look at the Bitcoin network. On October 22, Bitcoin Core merged a security policy change specifically aimed at vulnerabilities that can be discovered with a simple prompt to LLMs (large language models). In the past, such issues could remain confidential for up to a year; now, fixes and releases must be expedited. The author of the change, Antoine Poinsot, stated plainly: LLMs are "significantly lowering the threshold for discovering certain types of problems."

This is not an isolated case. Two critical PHP vulnerabilities discovered with the help of AI models have put approximately 1.3 million hosts exposed on the internet at risk. Initia has suspended its entire network: attackers exploited what co-founder Zon referred to as a "Day 0 bug" to mint coins and transfer out approximately $2.7 million across chains. It cannot yet be confirmed whether AI was used in this attack, but it is not far-fetched to say it played a role to some extent.

Data is also moving in the same direction. DefiLlama's hacker incident database shows that there have been 112 attacks exceeding $1 million in 2026 so far; the total for 2025 was 70. Anthropic's research on smart contracts found that the "vulnerability exploitation revenue" of cutting-edge models in simulated environments doubles approximately every 1.3 months.

What should be done when attackers have tireless and constantly evolving vulnerability hunters at their disposal? The crypto industry is converging on two very different answers.

Agile Camp: Change Anytime, Stop Anytime

The first answer is to remain flexible: able to quickly patch and quickly hit the brakes.

Starknet is currently the clearest example. On Thursday, its community voted to explore transitioning to an independent post-quantum L1. One reason is the desire to upgrade cryptography at its own pace. StarkWare stated: "We cannot rely on Ethereum to run fast enough to ensure our security." CEO Eli Ben-Sasson currently estimates the arrival of quantum computing to be "two years away" and believes AI is accelerating this timeline.

Ethereum researchers are also on alert. Earlier this month, Justin Drake urged the industry to prepare for a "bunker mode," which involves moving funds to entirely new, safer addresses. The background is a wave of AI-driven mathematical breakthroughs.

But agility comes at a cost. Every admin key and every upgrade path is both an attack surface and a point of dependency. Changing the rules themselves can also create new bugs. Thus, Ethereum removed Glamsterdam from the Hoodi testnet this week because research showed that its Gas changes could alter the behavior of already deployed contracts.

Minimalist Camp: Minimize the Attack Surface

The second answer is to narrow the target.

Ethereum developer Ross (z0r0z) stated directly on Thursday: move critical digital infrastructure code onto public chains so that everyone can verify what has happened; then move towards serverless; and even write applications into blockchain code so that they run the same every time. This idea suddenly doesn’t seem so strange.

This is certainly a bit ambitious. But it essentially embodies Ross's "let go test": if the builders disappear tomorrow, can the system still run safely? The smaller, more deterministic, and easier to verify the code is, the fewer places there are to be breached, and the fewer entities that need to be trusted. Ross added in a reply: "Developers should focus their energy on simpler code."

The same intuition is also appearing in Ethereum cryptography. Vitalik stated that Ethereum's roadmap has shifted to "only hashing," partly because hashing is designed without structures that allow for AI-accelerated mathematical exploitation.

The opposite is equally clear. Public, immutable code can also be read by AI attackers; once it goes live, it cannot be patched. Therefore, minimalism is best applied when the code is small enough to be exhaustively checked.

AI Proofs Make "Unpatchable" Less Daunting

This brings us to formal verification. Formal verification is the use of mathematical proofs to ensure that code does not violate certain rules.

Historically, formal verification has been prohibitively expensive. Building the seL4 operating system kernel took only two person-years, but verification took 20 person-years. However, new research released by Anthropic and Theorem on Thursday shows that this path is becoming cheaper: using Claude to verify 239 entry points in 123 open-source libraries, under specific assumptions, these entry points will not crash regardless of input, up to 64MB. The entire process took only a few weeks.

There are costs as well. The scale of proofs will grow with code bloat. In the aforementioned work, a typical proof was about 600,000 lines, corresponding to approximately 18,000 machine instructions, potentially consuming hundreds of millions of AI tokens. Moreover, proofs only cover the properties you specify and do not equate to excluding all bugs.

But it is important to note who benefits the most: small, single-purpose code. This is precisely the type of code that minimalists want to put on-chain. If AI continues to drive down the cost of proofs, "unpatchable" will not be so critical, as the code will increasingly require fewer patches.

Of course, systems like L1 and rollups are large and still evolving, and they cannot do without agility. However, under the new paradigm of AI, the "let go test" is increasingly resembling the core metric of security strategies rather than just an ideal of decentralization. These trends are worth ongoing attention.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.