On the one hand, CZ is confident that the encryption securing Bitcoin is tougher than similar infrastructure behind the internet and most banking systems.
However, the weak link, as highlighted by the former Binance CEO, is the phishing and social engineering damage that AI can do with leaked data.
Ethereum co-founder Vitalik Buterin shares CZ’s optimism about AI not cracking blockchain cryptography. Buterin feels confident enough in that position that he continues to hold most of his wealth in crypto.
Not everyone agrees with CZ and Buterin
While both co-founders agree that proof-of-work and hashing underlying cryptography are solid, others are not so bullish.
Just this month, Ethereum Foundation researcher Justin Drake declared a “bunker mode” alert on the possibility that an AI-discovered mathematical breakthrough could break the Elliptic Curve Digital Signature Algorithm (ECDSA) scheme that proves a Bitcoin or Ethereum transaction came from the real key holder.
After years of preparing cryptography against future quantum threats, Drake’s warning opened a conversation about AI cracking cryptography before quantum computers with capability ever arrive.
Drake’s warning about private key recovery happening “in months not years” drew sharp pushback from the industry, including head of cryptography at Coinbase, Yehuda Lindell and Blockstream CEO Adam Back.
Lindell called Drake’s idea “fear mongering,” while Back, who also invented hashcash, dismissed Drake’s post as “fud-burger.”
Drake got mild support from Johns Hopkins cryptographer Matthew Green, who said he would not assume human analysis as flawless after seeing machines beat humans on hard math.
Bitcoin Core drops the embargo for easy-to-find bugs
The main software that runs the Bitcoin network, Bitcoin Core, has announced an overhaul of its approach to handling security flaws. In an email to the Bitcoin Development Mailing List on Thursday, developer Antoine Poinsot said large language models have made some bugs so trivial to rediscover that keeping them secret no longer buys users much time.
The old model relied on long embargoes. That gave people a window to upgrade, but it also stopped fixes from being backported to older versions. For a bug an attacker could surface with one AI prompt, Poinsot said, the math no longer works. “The embargo period achieves little, but it delays the availability of a fixed release,” he wrote.
Under the rewrite, any flaw tagged “easily discoverable” now gets a fix shipped across every maintained version as fast as possible, with an advisory published alongside.
Everything else keeps severity-based timelines: low-severity issues go public two weeks after a major release carries the fix, while medium and high ones wait until the last affected version hits end of life, roughly a year out. Critical bugs fall outside the standard rules.
“I’ve disagreed with Antoine’s approach to security in the past, but this is a good update,” said Luke de Wolf, host of the Bitcoin Infinity Show.
The attacks around the math are already here
The part where CZ and the policy change agree on is that the pressure is real, not hypothetical.
In August, a 16-person volunteer Bitcoin Red Team found hundreds of high- or critically rated flaws during an AI-assisted sweep that turned up close to 5,000 possible flags across over 390 projects.
Core Lightning developers told operators to upgrade or pull their nodes offline after a wave of AI-generated bug reports in the same month.
