AI exposed a massive flaw in top crypto network and experts warn banks could be next
An AI model found a four-year-old Zcash bug that could have let someone mint unlimited tokens. Researchers say similar flaws may exist in crypto and banking software.
Intelligence analysis by GPT-5.4 Mini
A Zcash vulnerability that sat undetected for years was uncovered with Anthropic's Opus 4.8, raising alarms that AI will find more hidden bugs across crypto and bank systems. Some see formal verification as the long-term fix; others warn defenders are in a costly race against well-funded attackers.
An AI found a hidden crack in a money system that had been sitting there for years. It was like a smart flashlight spotting a hole in a safe, which is why experts now worry that other crypto systems and even banks may have similar holes.
Analysis
What happened
A security issue in Zcash went unnoticed for four years until Shielded Labs, a nonprofit developer on the network, found it using Anthropic's Opus 4.8 model. Zcash said the vulnerability was remediated. According to the article, the flaw could have let an attacker issue unlimited counterfeit tokens if it had remained hidden.
The disclosure rattled the market. The article says Zcash fell nearly 38% over the last 24 hours, and some social posts treated the incident as evidence that crypto security is being outpaced by AI.
Why researchers are worried
The bigger concern is not only Zcash. Ben Goertzel of SingularityNET told CoinDesk that similar vulnerabilities are likely to exist in other cryptocurrencies and in bank software too. His view is that AI tools will increasingly uncover bugs in the coming weeks and months across both decentralized and centralized systems.
Haseeb Qureshi of Dragonfly took a more optimistic view of the same trend. He argued that if AI can find bugs, it can also help deliver the fix: formal verification. He described formally verified cryptography as software that cannot have implementation bugs by construction.
The proposed defense
The article centers on formal verification as the long-term answer. Vitalik Buterin is cited describing it as writing proofs of mathematical theorems so they can be checked automatically. Qureshi said this is the only path forward for mission-critical software, and that Zcash has made it part of its roadmap.
Ronghui Gu of CertiK added a more practical warning: attackers can spend huge amounts of AI compute on one target, while security teams must defend many clients at once. That makes defense asymmetric and expensive, so firms need automated scanning built into everyday development rather than relying on occasional audits.
Key points
- An AI model helped uncover a four-year-old Zcash flaw that could have enabled unlimited token issuance.
- Zcash said the vulnerability was remediated after disclosure.
- The incident triggered a sharp selloff, with Zcash reportedly down nearly 38% in 24 hours.
- Researchers warn similar bugs may exist in other cryptocurrencies and in bank software.
- Several experts point to formal verification as the main long-term defense against AI-assisted bug hunting.
If AI keeps finding bugs before attackers do, more crypto and banking software could be fixed faster than before. The article also suggests formal verification could make critical code much harder to break by design.
The downside is that hackers may use the same AI tools to hunt for weaknesses faster than defenders can patch them. The article also warns that banks and other centralized systems may have serious bugs hiding in their software too.
