AI is Supercharging Bug Discovery, and the Crypto Industry is Rapidly Reorganizing to Survive

Artificial intelligence is growing at an alarming pace when it comes to identifying vulnerabilities in software code, and the cryptocurrency and blockchain ecosystem is beginning to fundamentally reorganize around that new reality. The implications of this paradigm shift are touching everything from foundational layer-one protocols to smart contract security, forcing developers to rethink how code is written, deployed, and defended.

Just look at the original blockchain this week to understand the speed of this evolution. On Thursday, October 22nd, Bitcoin Core formally merged a security policy change specifically designed to handle bugs “that can be found with a simple prompt to an LLM.” Rather than keeping these potential threat vectors sitting under traditional vulnerability embargoes for up to a year—a practice historically used to give developers breathing room to coordinate patches—those vectors will now be fixed and shipped as rapidly as possible.

As the change’s author, Antoine Poinsot, noted, large language models are “drastically reducing the bar to find certain classes of issues.” This means that the traditional security through obscurity or slow-paced coordination model is no longer viable when automated tools can dissect complex codebases in seconds.

The threat is far from theoretical or isolated to digital assets. Meanwhile, two critical PHP software flaws discovered with the help of advanced AI models recently left roughly 1.3 million internet-exposed hosts vulnerable to attack. Shortly after, the Initia network was forced to halt its entire operation after an attacker successfully exploited what cofounder Zon described as a “Day 0 bug” to mint unauthorized tokens and bridge out approximately $2.7 million. While there has been no definitive confirmation yet that artificial intelligence was utilized directly for this specific hack, industry observers note that it seems entirely safe to assume AI was leveraged in some capacity given the sophistication and speed of modern exploitation techniques.

Data tracking platforms are reflecting this stark increase in systemic risk. DefiLlama’s comprehensive hacks database, which has been tracking exploit trends closely, now logs 112 hacks resulting in losses of more than $1 million so far in 2026. This figure already dwarfs the 70 major hacks recorded across the entirety of 2025. Furthermore, recent research published by Anthropic into smart contract security revealed that frontier AI models’ simulated exploit revenue has been doubling roughly every 1.3 months throughout 2025, illustrating a terrifying curve of escalating hacker capabilities.

Faced with an environment where malicious actors have tireless, constantly improving automated bug hunters on tap, the broader crypto industry is rapidly converging on two very different strategic answers to survive the coming wave.

The agility approach

The first major philosophical answer gaining traction across the industry is to stay nimble, maintaining the operational ability to patch, upgrade, or freeze systems quickly when a threat is identified.

Starknet stands out as one of the clearest examples of this philosophy in action today. On Thursday, its community voted overwhelmingly to research the possibility of becoming an independent post-quantum layer-one network, driven in part by the desire to upgrade its underlying cryptography on its own schedule rather than waiting for broader ecosystem consensus. As StarkWare articulated in public statements, the network “can’t depend on Ethereum moving fast enough to ensure our safety.” StarkWare CEO Eli Ben-Sasson now pegs the practical arrival of quantum computing threats at roughly two years away, arguing that rapid advancements in artificial intelligence are drastically speeding up the overall timeline.

Ethereum researchers are also on high alert regarding these accelerating risks. Earlier this month, core researcher Justin Drake publicly urged the broader crypto industry to begin planning for “bunker mode”—a defensive posture involving the movement of funds to fresh, inherently safer addresses—following a worrisome wave of AI-driven mathematical breakthroughs.

To be fair, however, maintaining extreme operational agility comes with its own distinct set of security costs. Every administrative key, multi-signature arrangement, and upgrade path introduced into a protocol is also an additional surface area to attack or depend upon. Furthermore, changing the rules of a live network can inadvertently create entirely new bugs of its own. This exact hazard was highlighted when Ethereum developers decided to pull the "Glamsterdam" upgrade from its Hoodi testnet this week over fresh research showing that its proposed gas changes could fundamentally alter how already-deployed smart contracts behave in production.

The minimalism approach

The second major answer taking shape across the developer community is to shrink the attack target altogether by stripping code down to its bare essentials. Ethereum developer Ross, widely known as z0r0z, framed this minimalist ethos succinctly this week, emphasizing that the future of resilient code relies on radical simplicity.

This mindset is essentially a modern software expression of the classic "walkaway test" philosophy—asking whether a system can continue working safely and indefinitely even if its original builders disappear tomorrow. Small, deterministic codebases that anyone can independently verify leave fewer physical places for bugs to hide and fewer trusted third parties to compromise. As Ross emphasized in subsequent technical discussions, developers must fundamentally refocus their efforts on writing simpler code.

This exact defensive instinct is also manifesting within Ethereum’s core cryptography roadmap. Ethereum co-founder Vitalik Buterin noted recently that the network’s roadmap has increasingly gone “hash-only,” partly because cryptographic hashes are specifically engineered to possess no exploitable mathematical structure for AI-accelerated math engines to crack.

Of course, this minimalist approach carries its own built-in flip side. Public, immutable code is just as readable by AI-powered attackers as it is by defenders, and once it is deployed live on a blockchain, it generally cannot be patched. Therefore, minimalism works best when the underlying code is kept small enough to be checked exhaustively before launch.

Where AI proofs come in

This is precisely where formal verification—the process of mathematically proving that a piece of code cannot violate specific security rules under any conceivable scenario—becomes profoundly compelling.

Historically, formal verification has been brutally expensive, slow, and labor-intensive. For instance, the seL4 operating system kernel took two person-years to initially build, but an astonishing 20 person-years to formally verify. Yet in groundbreaking new research published on Thursday alongside Theorem, Anthropic demonstrated that its Claude AI model could be used to prove that 239 entry points across 123 open-source libraries cannot crash on any input up to 64 megabytes, under certain specific operational assumptions, and accomplished this monumental task in just a matter of weeks.

The catch with this emerging technique is that mathematical proofs scale directly with the complexity of the code. A typical proof generated in the aforementioned research effort ran to approximately 600,000 lines of proof logic for a program consisting of only about 18,000 machine instructions, meaning the process can consume hundreds of millions of AI tokens. Additionally, a formal proof only covers the specific properties and invariants explicitly defined by the programmer, rather than guaranteeing the absence of every possible bug.

However, it is worth noting who stands to benefit the most from cheaper, AI-accelerated proofs: small, single-purpose pieces of code. This is the exact variety of code that minimalist developers want to deploy on-chain. If artificial intelligence continues driving down the computational and labor costs of generating formal proofs, the traditional downside of unpatchable code will matter significantly less, because the code will increasingly reach a state where it simply does not need patching in the first place.

Naturally, operational agility will undoubtedly remain necessary for massive, continuously evolving systems like layer-one networks and complex rollups for the foreseeable future. Yet in this newly emerging artificial intelligence paradigm, the age-old walkaway test is increasingly looking less like a mere decentralization ideal and more like an absolute security north star. As developers and researchers adapt to a landscape shaped by automated adversaries, market participants would be wise to keep a close eye on these shifting trends.