(Bloomberg) — When Eli Ben-Sasson helped create the Zcash cryptocurrency nearly a decade ago, the cryptographer worried about human adversaries. He didn’t expect that machine intelligence would one day expose a flaw that had eluded years of expert human judgment.
That reality rattled investors recently after a security researcher working with Zcash used Anthropic’s Claude Opus 4.8 to uncover a critical vulnerability that had gone undetected for more than four years. After Zcash disclosed the flaw on June 4, the token — which traded at far higher levels just weeks earlier — tumbled about 50% as traders reassessed the security of one of crypto’s most prominent privacy networks.
The exploit struck at the heart of Zcash’s value proposition. The cryptocurrency relies on advanced cryptography to enable users to shield transaction details from public view, and investors have long viewed that mathematical foundation as one of the network’s defining strengths. The discovery that a flaw capable of creating an unlimited supply of tokens had gone undetected for years raised fresh questions about how artificial intelligence could reshape the race between those securing crypto networks and those trying to hack them.
Crypto investor Arthur Hayes said he sold his entire Zcash position after the disclosure, citing concerns about the network’s integrity. But in Ben-Sasson’s own telling, Zcash got lucky. The flaw was discovered by a “white-hat” hacker, allowing the project to quickly warn investors and fix it. Other crypto protocols may not be as fortunate, he warned.
“There will be more exploits,” Ben-Sasson said in an interview. “There will be cases where the bad guys will find the bugs first and exploit protocols.”
Taylor Hornby, a security researcher who works with Zcash, spotted the vulnerability with the help of Opus 4.8, just one day after Anthropic had released the latest model on May 28, according to a statement posted on the crypto project’s community forum by Zcash’s founder Zooko Wilcox-O’Hearn.
The exploit had existed for more than four years and would have allowed an attacker to counterfeit an unlimited amount of Zcash tokens, the statement said.
The discovery comes as crypto developers grapple with a security landscape increasingly shaped by AI. Cybersecurity researchers believe hackers are already using AI to identify targets, scan software for vulnerabilities and design increasingly sophisticated exploits, compressing work that once took months into days or even hours. Anthropic PBC has shut down access to its most advanced AI models after the US ordered it to block all foreign nationals from using them on national-security grounds.
The Zcash incident showed that even exploit discoveries by researchers aligned with crypto projects can rattle investors — hinting at the potential for similar price crashes as other protocols employ AI to unearth flaws.
Such concerns are particularly acute in decentralized finance, where billions of dollars have been lost to hacks in recent years. Researchers say the same AI tools helping developers audit code are also lowering the barriers for attackers, creating an arms race across the industry.
For years, security reviews of crypto protocols relied heavily on researchers manually examining code and cryptographic proofs. More recently, AI tools have become part of that process, said Josh Swihart, chief executive officer of the Zcash Open Development Lab.
Wilcox-O’Hearn said it’s unlikely the Zcash vulnerability had already been exploited, though developers are still trying to determine that. Because Zcash allows shielded transactions, key details such as participant identities and transaction amounts are concealed, making retrospective analysis more difficult.
Nation-state groups including North Korea’s Lazarus Group have carried out some of the most sophisticated attacks targeting crypto. Unlike traditional financial transactions that move through banks and other intermediaries, stolen cryptoassets can often be moved through a range of tools designed to obscure ownership and transaction histories. The wider adoption of AI has created new security questions for crypto projects, particularly given the open-source nature of many blockchain protocols.
“Open-source software may be more vulnerable because attackers can actually see the code. It may be easier for them to identify these vulnerabilities,” said Nicole Farrar, co-CEO of o1Labs, a company focused on privacy-preserving cryptography.
At the same time, developers increasingly view AI as an essential defensive tool. More digital infrastructure underpinning cryptocurrencies is expected to be audited by advanced AI models as researchers seek to match the capabilities that attackers may already possess.
More broadly, security threats for cryptocurrencies extend beyond AI. Concerns about future quantum computers breaking existing cryptographic protections have already prompted parts of the industry to explore new security standards. Some researchers have warned that sufficiently powerful quantum computers could one day threaten cryptographic systems underpinning networks including Bitcoin.
“It is going to happen more and more, and it is going to change what’s considered as the standard of care and best practices for security issues,” Farrar said.
More stories like this are available on bloomberg.com
