Changpeng Zhao, widely known as CZ and the founder of Binance, stated he does not believe artificial intelligence needs to break Bitcoin’s cryptography to create significant risks. His comments emerged as Bitcoin Core, the primary software for the Bitcoin blockchain, announced a major revision to its approach for disclosing software bugs in the new era of AI-driven threats.
AI’s actual risk to Bitcoin and crypto security
CZ explained in an X post that while Bitcoin’s encryption remains stronger than that used in most internet and financial infrastructure, the biggest vulnerability comes from social engineering and phishing enabled by AI rather than direct attacks on cryptography itself. He emphasized that greater risks stem from leaked data and sophisticated manipulation rather than technical breakthroughs in mathematics.
Ethereum co-founder Vitalik Buterin expressed similar confidence, maintaining that AI is unlikely to compromise the mathematical foundations of blockchain security. Buterin added he has sufficient faith in these protections, noting he continues to store most of his holdings in crypto assets.
CZ argued that “AI doesn’t need to break Bitcoin’s math to exploit vulnerabilities—phishing and social engineering using leaked data pose the most serious threats.”
Despite the consensus between CZ and Buterin regarding the strength of Bitcoin’s cryptographic algorithms, debate continues in the broader industry.
Industry divided on AI’s cryptography threat
Not all industry experts agree with the optimistic view of CZ and Buterin. This month, Justin Drake, an Ethereum Foundation researcher, raised the alarm on X by suggesting that rapid AI-driven mathematical advances could threaten the Elliptic Curve Digital Signature Algorithm (ECDSA), which secures transaction signatures for both Bitcoin and Ethereum.
ECDSA plays a fundamental role in securing blockchain transactions by ensuring only holders of specific private keys can authorize funds transfers.
Mini dictionary: ECDSA, or Elliptic Curve Digital Signature Algorithm, is a cryptographic scheme used to sign transactions securely in cryptocurrencies like Bitcoin and Ethereum. It leverages the mathematical properties of elliptic curves to ensure that only someone with the correct private key can generate a valid transaction signature.
Drake argued that AI might compromise private key security “more quickly than quantum computers,” warning that key recovery could occur “in months not years.” Industry leaders, however, pushed back. Yehuda Lindell, head of cryptography at Coinbase, dismissed the claims as “fear mongering,” while Blockstream CEO Adam Back referred to Drake’s concerns as “fud-burger.”
Matthew Green, a cryptographer at Johns Hopkins University, gave partial support to Drake’s warning, pointing out that “after witnessing machines outperform humans on hard mathematical problems, it’s unwise to assume human analysis is flawless.”
Bitcoin Core adapts security policy to address AI-driven threats
Bitcoin Core announced an updated policy for managing security vulnerabilities in response to the rising influence of AI. Antoine Poinsot, a core developer, explained in an email to the Bitcoin Development Mailing List that powerful language models have made some bugs so easy to discover that long embargoes on disclosure no longer protect users.
Previously, Bitcoin Core relied on extended embargo periods to give users time to upgrade, but this policy delayed the rollout of fixes to older versions. Poinsot stated, “The embargo period achieves little, but it delays the availability of a fixed release.”
Under the new rules, any bug designated as “easily discoverable” is now patched and communicated as quickly as possible across all supported versions, with public advisories released concurrently. Other issues will continue to follow their established disclosure timelines depending on their severity.
Luke de Wolf, host of the Bitcoin Infinity Show, commented, “I’ve disagreed with Antoine’s security approach in the past, but this is a good update.”
Growing evidence of AI-driven vulnerabilities
Both CZ and the Bitcoin Core team acknowledge that the AI-related threat is more than theoretical. Last August, a 16-person volunteer Bitcoin Red Team conducted an AI-driven review that identified hundreds of high- and critical-risk vulnerabilities across nearly 400 open-source projects. The analysis flagged close to 5,000 potential issues.
In the same period, Core Lightning developers recommended node operators upgrade or temporarily disconnect their systems due to a surge in AI-generated bug reports. These incidents underscore the urgency for updating security protocols as the AI landscape advances.
