Vitalik Buterin Says AI Is Unlikely to Break Bitcoin’s Core Security

Shapira’s prediction was specific: he assigned a 50% probability that Bitcoin’s price would fall by more than half within two years because AI would undermine perceived security and robustness. 30 Buterin’s answer was equally direct: he said he took the opposite side.

Buterin’s case: core cryptography is not the most likely failure point

Buterin said he is optimistic about cybersecurity in the long run and characterized actual breaks of Bitcoin’s hash functions or proof-of-work as a tiny probability. 29 In other words, he did not argue that AI creates no security risk; he argued that an AI-caused collapse of Bitcoin’s underlying cryptographic and consensus model is an unlikely basis for the near-term price forecast.

He also framed the hard part as managing the transition to more capable AI systems. That framing matters because not every Bitcoin security incident has the same recovery path.

Network-layer problems versus consensus problems

Buterin separated issues Bitcoin can address through operational software changes from issues that would require broad agreement on the network’s rules:

• Network- and client-layer attacks: Problems affecting node software, mining-pool software, or network operations can potentially be addressed by upgrading clients and pools. Buterin placed these in the category Bitcoin should handle relatively well because they do not necessarily require system-wide social consensus. 29
• Core-rule or cryptographic failures: A genuine break of hashes or proof-of-work would be much more difficult because it could demand agreement on a fundamental protocol response. Buterin regarded that scenario as unlikely. 29

This is a distinction about recoverability, not a claim that patches are effortless or risk-free. A critical implementation flaw can still cause major disruption before a fix is deployed.

Why AI can raise risk—and help reduce it

AI can make it easier to analyze large codebases and identify implementation mistakes. That makes open-source infrastructure, bridges, wallets, and surrounding services important security targets even if Bitcoin’s base cryptography remains intact.

The defensive counterpart is stronger software assurance. Formal verification is a method of checking whether code satisfies explicitly specified properties. Reporting on Ethereum’s 2026 roadmap described formal verification, accelerated by modern AI, as part of the project’s security direction. 21 Buterin’s published work also includes exploration of formal verification. 26

That approach has limits: a proof can establish only the properties that were precisely specified. It does not automatically protect against a bad specification, flawed assumptions, unsafe integrations, compromised keys, or governance and operational failures.

What the Liquid breach did—and did not—show

The same-day Liquid incident illustrated the difference between a base-layer cryptographic failure and an implementation or bridge failure. Liquid reported that purported “white-hat” actors withdrew about 4,000 BTC, then valued near $320 million, from the federation wallet backing L-BTC. 3746

According to Liquid and SideSwap’s reported account, the withdrawal passed through SideSwap’s Peg-out Authorization Key (PAK) flow, but the PAK itself was not compromised. SideSwap said the L-BTC used in the order originated from a bug in Elements, the open-source software underpinning Liquid. 3646

Liquid disabled bridge nodes, preventing new transactions, while exchanges halted or prepared to halt L-BTC deposits and withdrawals. The network also said other Liquid-issued assets, including USDT, DePix, and real-world assets, were unaffected. 3646

The actors’ “white-hat” description was self-asserted and should not be treated as independently verified. 3746

Liquid is not Bitcoin’s base layer

Liquid is a federated Bitcoin sidechain developed with Blockstream, with a security and trust model different from Bitcoin’s decentralized proof-of-work network. During the incident, reporting indicated that Bitcoin’s base layer continued operating normally. 35

That is why the event is not evidence that AI defeated SHA-256, captured Bitcoin mining, or broke Bitcoin consensus. It is evidence that valuable crypto systems can be exposed through software defects and peg mechanisms around a blockchain—precisely the category of risk that requires careful engineering, auditing, upgrade processes, and clearer assurance methods.

Bottom line

Buterin’s disagreement with Shapira was not a dismissal of AI security risk. His position was that Bitcoin is more likely to face patchable software and network-layer threats than an imminent AI-driven break of its hashes or proof-of-work. 29

The Liquid incident reinforced the narrower warning: systems built around Bitcoin can have severe vulnerabilities even while Bitcoin’s base-layer consensus and cryptography remain uncompromised. 3637