Instead of relying solely on human auditors, developers may increasingly use AI to mathematically prove code behaves correctly.
Vitalik Buterin, the co-founder of Ethereum, has responded to increasing concerns that AI-based bug hunting will overwhelm developers and create non-stop exploitation opportunities on blockchains.
According to him, in the near future, the use of this technology might actually make crypto systems more secure. He says that AI-assisted formal verification may become one of the strongest defenses against security failures in crypto and internet infrastructure.
AI Could Strengthen Security Instead of Breaking It
Formal verification is the practice of writing mathematical proofs about software that a computer can automatically verify instead of people reviewing them. This concept has been available for decades; however, it has never caught on because generating such proofs manually was rather tedious for software developers, so many of them never bothered.
Now, Buterin is saying that AI has changed this equation, and instead of developers writing the proofs themselves, they can ask an AI to write both the code and accompanying proofs. They then simply check that the final statement proved is actually the thing they wanted to prove.
The developer described a scenario where AI models become powerful enough to automate finding bugs in existing code and then asked what that would mean for systems where a single flaw can cost users everything.
His answer was that formal verification, done end-to-end, lets you mathematically prove that a piece of code behaves exactly as intended, so that a sufficiently powerful AI looking for flaws would be looking at code that has already been proven not to have them.
He also called out specific Ethereum infrastructure projects where this approach is already being attempted. One of them is Arklib, which is working toward a fully formally verified STARK implementation. Another is evm-asm, which is building an EVM written in low-level RISC-V assembly and verifying its correctness against a human-readable reference implementation.
You may also like:
On the question of which AI models are actually useful for this, Buterin said he found Claude and Deepseek 4 Pro both sufficient for writing Lean proofs.
He also flagged Leanstral, a smaller open-weights model fine-tuned specifically for Lean, as capable of running locally and outperforming much larger general-purpose models on formal verification benchmarks.
But There Are Limitations
Despite his enthusiasm for formal verification, Buterin also devoted a substantial part of his essay to explaining the ways it has failed in practice.
This includes bugs in verified compilers; libraries where only part of the code was proven, and the unproven parts turned out to be the problem; and specifications that were technically proven but simply did not capture what the developer actually wanted to guarantee.
However, his broader framing is that formal verification is not a replacement for all security practices but one powerful tool in a longer-running trend toward fewer bugs per line of code.
The background is relevant here, considering that on the day Buterin’s post appeared, the crypto sector was reeling from a third major exploit in just four days after a hacker made off with more than $76 million worth of crypto from the cross-chain bridge of the Echo Protocol.
Days earlier, reports emerged regarding a hack on THORChain, which cost the platform more than $10 million.
Another attack happened after that one, targeting the Verus-Ethereum Bridge, whereby a hacker took advantage of the lack of a validation check to steal $11.58 million. That is the kind of specific, localized flaw that a formal proof check may have caught.