Vitalik Buterin has rejected the claim that increasingly capable AI hackers will make cybersecurity effectively unwinnable, arguing on Sept. 17 that advanced verification tools could eventually give defenders a structural advantage.

Buterin wrote in his Sept. 17 post on X that he disagrees with the increasingly common view that “AI hacking means cybersecurity is doomed.” He said people who continue holding cryptocurrency are implicitly betting that secure digital systems can survive stronger automated attacks, adding that roughly 90% of his own net worth remains in crypto.

His argument centers on formal verification, a technique that uses mathematical specifications and proofs to determine whether software behaves according to predefined properties. Buterin used advanced mathematical theorem proving as an analogy, saying sufficiently capable AI could help prove that “this program is secure” even when the software itself is complex.

Buterin says formal verification can favor defenders

Buterin’s argument does not treat AI security as a race where defensive researchers simply find bugs before attackers. His post instead describes a model where developers define the properties a system must satisfy, then use automated proof tools to establish that the implementation obeys them.

Ethereum’s own formal verification documentation describes the technique in narrower terms. It says formal verification can mathematically prove that a smart contract complies with a formal specification, offering stronger guarantees than ordinary testing for the properties included in that specification.

The same Ethereum documentation identifies an important limitation behind Buterin’s comments. A proof establishes that software satisfies the specification being checked; it does not automatically prove that developers defined every security property correctly. Poorly chosen or incomplete specifications can leave behavior outside the proof.

Buterin made the same distinction in his post. He argued that defining “security” too narrowly can omit attack paths involving areas such as protocols, servers, databases, networking layers, caches or other supporting components. His proposed direction is therefore to verify more of the complete system instead of labeling a small group of modules as security-critical.

Buterin had already described AI-assisted formal verification as a possible “final form” of software development. His earlier comments applied the approach to areas including Ethereum consensus, zero-knowledge systems and quantum-resistant cryptography.

Ethereum is already testing AI-assisted security

Ethereum researchers are already using AI in security work, although current systems remain far from automatic proof of whole-system security.

The Ethereum Foundation Protocol Security team reported in July that coordinated AI agents had found real defects in systems used by Ethereum. One confirmed finding involved a remotely reachable crash in Rust libp2p’s Gossipsub networking implementation.

The flaw became CVE-2026-34219. The U.S. National Vulnerability Database record says versions before 0.49.4 could be crashed remotely through a crafted PRUNE message that triggered an arithmetic overflow during Gossipsub backoff handling. Version 0.49.4 fixed the issue.

The Foundation’s security team said vulnerability discovery was not the hardest part of the AI workflow. Researchers found that AI agents frequently generated convincing reports involving unreachable execution paths, debug-only failures or formal proofs that technically passed while proving a weaker property than intended.

Independent reproduction remained a requirement before the team accepted a finding. The Foundation said automated checks and human review were needed because an agent could produce a valid-looking proof that failed to constrain the software behavior researchers actually wanted to test.

The Foundation’s experience was described as a triage problem: AI could generate large numbers of candidate vulnerabilities, but researchers still had to determine whether each issue was reachable and meaningful in production.

Formal verification is entering Ethereum’s protocol roadmap

The Ethereum Foundation has separately made formal verification part of its current protocol research program. In its Sept. 7 protocol priorities update, the Foundation said formal verification would serve as cross-cutting tooling across its remaining multi-year research areas. The document covers work on privacy, state, zkEVM development, post-quantum security and other protocol components through 2029.

The same roadmap says development of an L1 zkEVM is expected to advance formal-verification tools, workflows and verified cryptographic components. Ethereum researchers are working toward a system where validators eventually verify succinct execution proofs instead of independently re-executing every block.

A separate Ethereum Foundation project launched in August is already combining AI agents with machine-checked proofs. The better.codes project lets researchers direct AI systems at a cryptographic soundness problem formalized in Lean, while the Lean kernel checks whether submitted proofs satisfy a fixed theorem statement.

The Foundation’s Q2 funding report lists further work combining large language models with formal methods. Projects include ETHeorem for checking Ethereum client implementations against specifications, SPECA and LeanAgent for automated protocol compliance work, and formal verification involving RISC-V zkVM infrastructure.

Ethereum’s updated technical roadmap gives formal verification a role alongside privacy, zero-knowledge proofs and post-quantum protection. Buterin’s Sept. 17 comments therefore continue an existing research direction instead of announcing a new upgrade or scheduled fork. His post did not name a new EIP, deployment date or mandatory rule requiring every Ethereum program to undergo formal verification.

Current AI evidence shows stronger offensive capability too

Recent cybersecurity research supports the concern that AI is making attackers more capable, even as defensive use expands. Anthropic said in itsSeptember threat intelligence report that it had observed malicious actors using AI to automate vulnerability research, exploit development and multi-target campaigns. The company said some operators maintained automated workflows that could conduct vulnerability research continuously.

Earlier research from Anthropic found similar evidence at scale. Its coordinated disclosure dashboard said that, by Aug. 26, the company had disclosed 2,300 AI-discovered vulnerabilities across 392 open-source projects, with 421 patched upstream at that point.

Anthropic has described the same technology as useful for defense. Its Project Glasswing initiative reported using frontier models with security companies and software vendors to locate high- and critical-severity flaws before malicious actors could exploit them.

The offensive side remains measurable. Anthropic’s June study examined 832 accounts associated with malicious cyber activity from March 2025 through March 2026 and found threat actors using AI across multiple stages of cyber operations. Buterin had already rejected a separate argument that AI-driven security risks could severely damage confidence in Bitcoin. He said network-layer problems could often be addressed through software and mining-infrastructure upgrades, while describing actual breaks of Bitcoin’s hashes or proof-of-work mechanism as highly unlikely.

Anthropic’s September report said its investigators had identified operators using AI-built exploit pipelines against security appliances and government targets, with some campaigns producing previously unknown vulnerabilities that attackers validated in their own test environments.

The number of crypto millionaires worldwide has fallen to 135,694 as the digital asset market contracted to $2.6 trillion, while Bitcoin still accounts for more than two thirds of people holding at least $1 million in crypto.

Henley & Partners said in its Crypto Wealth Report 2026 that 92,272 people now hold at least $1 million in Bitcoin, with the asset accounting for roughly $1.6 trillion of the total crypto market as of Aug. 31.

Bitcoin was trading around 38% below its October 2025 peak when the report was compiled. Henley described the decline as milder than previous major Bitcoin downturns, with the corrections following the 2011, 2013, 2017 and 2021 peaks each exceeding 75%.

At the upper end of the wealth scale, the report counted 290 crypto centimillionaires with digital assets worth at least $100 million. Of those, 151 held their wealth in Bitcoin. Another 23 people qualified as crypto billionaires, including nine whose wealth was tied to Bitcoin.

Crypto millionaire numbers fall during the downturn

The latest figures represent a reversal from the sharp wealth expansion recorded during the previous market cycle. In 2024, crypto.news previously reported that the number of people holding more than $1 million in digital assets had climbed 95% to 172,300, up from 88,200 in 2023.

Bitcoin millionaires numbered 85,400 in that 2024 report, while the market had 325 crypto centimillionaires and 28 billionaires. The 2026 figures therefore show fewer millionaires, centimillionaires and billionaires across the digital asset market, although the number of Bitcoin millionaires remains above its 2024 level.

A separate measure of Bitcoin wealth showed similar pressure during 2025. The number of Bitcoin millionaire addresses fell by 7,485 during the year, from 155,569 on Jan. 1 to 148,084 by Dec. 31, according to a Finbold report published in January. Addresses holding at least $10 million in Bitcoin rose from 15,319 to 16,368 over the same period.

Wallet counts cannot be directly compared with Henley’s estimate of individual wealthy holders because one person can control multiple addresses.

Despite the decline in the number of wealthy holders, Henley said digital asset ownership continued to expand. Its 2026 report estimated that 742 million people worldwide now hold some amount of crypto, including 371 million Bitcoin holders.

Henley said the crypto wealthy clients approaching the firm have tended to be younger and more internationally mobile than its traditional private clients. The firm described them as the first generation to have built substantial fortunes in an asset class that was not originally tied to a single country.

Dominic Volek, group head of private clients at Henley & Partners, said digital assets may move across borders but their owners remain subject to national tax, legal and regulatory systems.

“Crypto may be borderless, but the families who own it are not,” Volek said.

Wealthy crypto holders look at residence options

Henley said it has seen rising interest from wealthy digital asset holders seeking advice on residence and citizenship choices as they decide where to base their families and financial affairs.

Similar demand has emerged in offshore wealth planning. A September report found that wealthy crypto investors have increasingly sought offshore trusts for estate planning and tax purposes, although some trustees remain reluctant to accept digital assets because of volatility, custody risks and difficulties verifying the source of funds.

Guenther Dobrauz-Saldapenna, managing partner at Henley & Partners Switzerland, said self-custodied assets can move with their owners much faster than traditional wealth, increasing the role of residence, citizenship and regulatory choices in wealth planning.

Henley’s 2026 Crypto Adoption Index ranked Singapore first among 36 jurisdictions assessed on regulation, taxation, infrastructure, innovation and adoption. Singapore retained the top position for a fourth consecutive year and received the index’s highest score for innovation and technology.

The United Arab Emirates moved from fifth place last year to second, receiving a 10 out of 10 score for tax friendliness. Hong Kong ranked third, followed by the United States and Switzerland.

Malta placed sixth and recorded the highest regulatory environment score. Thailand, the United Kingdom, Cyprus and the Bahamas completed the top 10.

New entrants included the Bahamas in 10th place, the Cayman Islands in 12th, Bahrain in 13th, Argentina in 26th, Maldives in 31st, Naoero in 32nd and Paraguay in 35th.

Crypto wealth faces tighter reporting rules

Tax authorities are preparing to receive more information about crypto holdings and transactions as international reporting systems take effect.

Henley’s report said 76 jurisdictions had signed up to the Organisation for Economic Co-operation and Development’s Crypto-Asset Reporting Framework, with the first information exchanges among 46 jurisdictions expected in September 2027.

The number of participating jurisdictions has continued to change as more countries commit to the framework. Argentina committed to CARF this month and plans to begin automatic exchanges of crypto transaction information by September 2029, bringing the committed group to 77 jurisdictions.

Under CARF, covered crypto service providers collect customer identification and transaction information that can be exchanged between participating tax authorities. Data collection began in January 2026 across 48 jurisdictions, including the United Kingdom and European Union countries.

The framework does not capture every form of onchain activity. Chainalysis estimated in August that potentially taxable onchain crypto activity exceeded $457 billion globally in 2025, while transactions within the practical scope of international reporting rules accounted for roughly 14% of the identified total. The remaining activity included decentralized exchange transactions, peer to peer transfers, crypto income and payments.

Henley said growing reporting requirements are becoming another consideration for internationally mobile crypto holders when choosing where to live and structure their affairs.

Volek said investors are increasingly looking at regulatory quality, courts, safety and international access when assessing jurisdictions.

“Crypto may move across borders with unprecedented ease, but its owners still need to decide which jurisdictions they want to be connected to,” he said.

Moscow Exchange has scheduled the Sept. 22 launch of perpetual futures tied to Bitcoin, Ether, Solana, XRP and Tron indexes, with the cash-settled contracts restricted to qualified investors.

Moscow Exchange said in itsofficial Sept. 16 announcement that the products will operate as one-day futures with automatic rollover, giving investors exposure to cryptocurrency price movements without receiving or transferring the underlying digital assets. The exchange’s contract specification is set to take effect on Sept. 22.

The Sept. 16 announcement remains the latest MOEX launch notice located as of Sept. 17. No subsequent exchange notice reviewed changed the scheduled Sept. 22 start.

MOEX perpetual futures will cover five crypto indexes

The new contracts will track five indexes calculated by Moscow Exchange. BTCUSDF will reference the MOEX Bitcoin Index, while ETHUSDF will follow the exchange’s Ether benchmark. SOLUSDF, XRPUSDF and TRXUSDF will track the corresponding Solana, XRP and Tron indexes.

MOEX already offers monthly futures tied to the same five cryptocurrency indexes. Bitcoin and Ether index futures began trading in November 2025, while contracts linked to Solana, XRP and Tron followed on May 14, 2026. Before the altcoin futures arrived, Moscow Exchange changed how its cryptocurrency benchmarks were calculated. Since May 13, the indexes have used prices from major cryptocurrency exchanges and update every 15 seconds during relevant trading periods. MOEX then uses the indexes to calculate settlement values for its existing contracts.

MOEX introduced indexes for SOL, XRP, TRX and BNB in May using data from Binance, Bybit, OKX and Bitget. At the time, the exchange said the benchmarks could later support new trading instruments. SOL, XRP and TRX subsequently became underlying indexes for monthly futures and will now receive perpetual contracts. BNB is not included in the five perpetual futures announced for Sept. 22.

Contracts settle in rubles without delivering crypto

Although each new contract will be quoted in U.S. dollars using its corresponding index value, MOEX said financial settlement will take place in Russian rubles. Investors therefore will not need to hold Bitcoin, Ether, Solana, XRP or Tron to trade the products.

MOEX describes all of its current crypto futures as settlement contracts. At expiration or settlement, no cryptocurrency changes hands; only the financial result is calculated and settled through the exchange and participating brokers. Its product documentation says movements in USD/RUB affect the ruble value of the result because the underlying futures prices are expressed in dollars.

Unlike MOEX’s existing monthly crypto-index contracts, the new instruments are one-day futures with automatic rollover. Funding will be calculated under the exchange’s published specification, with MOEX setting the K1 parameter at 0% and K2 at 0.35%.

The exchange already runs perpetual futures across other asset categories. Its existing perpetual lineup contains 31 contracts covering currency pairs, MOEX indexes, the government bond index, precious metals and Russian and foreign securities. Maria Patrikeeva, managing director of the MOEX derivatives market, called the launch “an important milestone in the development of the Russian derivatives market.” She said the exchange was seeing “strong investor demand” for derivatives tied to digital assets.

Crypto futures demand has passed 600 billion rubles

MOEX said more than 72,000 qualified investors have traded its digital-asset futures since the exchange began offering crypto-linked contracts, with cumulative transaction volume exceeding 600 billion rubles. The figures come from Moscow Exchange and have not been presented as Bank of Russia statistics.

The exchange’s current crypto derivatives product page still displays an earlier August snapshot showing 71,000 clients had traded crypto-related products since launch. It lists average daily turnover of 2.5 billion rubles during August and a record daily volume of 10.2 billion rubles on Aug. 21.

The newer 72,000 figure in the Sept. 16 release covers activity after that August snapshot. MOEX did not publish a separate breakdown showing how much of the cumulative 600 billion rubles came from Bitcoin, Ether, Solana, XRP or Tron contracts.

However, Moscow Exchange first entered regulated crypto-linked futures with a contract based on BlackRock’s iShares Bitcoin Trust ETF in June 2025. An Ether ETF-linked contract followed in August, before MOEX moved to futures directly referencing its own Bitcoin and Ether indexes in November.

As crypto.news reported when the first Bitcoin ETF future launched, access was restricted to qualified investors from the start. The IBIT-linked contract was quoted in dollars and settled in rubles, establishing the same basic cash-settlement structure later used for direct cryptocurrency-index futures.

MOEX’s 2025 annual report said more than 40,000 clients traded its crypto-linked contracts during that year, generating more than 212 billion rubles of turnover.

Russia still limits these derivatives to qualified investors

The structure follows rules the Bank of Russia introduced in May 2025 for financial products tied to cryptocurrency prices. The central bank said financial institutions could offer qualified investors derivatives, securities and digital financial assets linked to cryptocurrency values, provided the products did not involve physical delivery of cryptocurrency.

MOEX repeats the restriction on its own crypto-futures page. Both individuals and legal entities must hold qualified-investor status to trade the exchange’s cryptocurrency futures, and brokers determine final client access.

Russia’s rules for direct cryptocurrency transactions changed on Sept. 1, 2026. Under the new legal framework described by the Bank of Russia, both qualified and non-qualified investors can access cryptocurrency through regulated intermediaries, although the two groups operate under different limits.

Non-qualified investors must pass a test and are limited to purchases of eligible liquid cryptocurrencies worth no more than 300,000 rubles per year through each intermediary. The Bank of Russia identified Bitcoin, Ether and USDT for retail access under its liquidity and price-history criteria. Qualified investors can trade cryptocurrencies without the same purchase ceiling after completing the required testing.

As crypto.news reported when the new framework took effect, the Sept. 1 rules created regulated routes for cryptocurrency trading and custody through supervised intermediaries. MOEX’s Sept. 22 perpetual futures remain a separate derivatives product and are limited to qualified investors under the exchange’s specifications.

The Bank of Russia expanded routes to qualified-investor status shortly before the new crypto framework started. Rules effective Aug. 31 allow individuals to qualify through approved Russian financial-market examinations and certificates, including a MOEX Investor Certificate, alongside existing asset, income, experience and education criteria.

Hong Kong has laid out plans to expand regulated stablecoin trading, tokenized real world assets and digital bond infrastructure as part of its 2026 Policy Address, while preparing round the clock central bank digital currency settlement under EnsembleTX by the end of the year.

The Hong Kong SAR Government said in the policy document released on Sept. 16 that the Securities and Futures Commission will enhance virtual asset licensing rules and develop specific regulatory guidelines for virtual asset service providers.

Regulators plan to improve rules for tokenized investment products so that gold and other suitable real world assets can be issued and traded in tokenized form on licensed platforms. Regulated stablecoins are expected to be permitted for trading on licensed virtual asset platforms and used to settle tokenized money market funds.

The measures form part of Hong Kong’s plan to develop its financial markets through digitalization and tokenization, covering stablecoins, digital bonds, tokenized deposits, wholesale CBDC settlement and digital asset custody surveillance.

Hong Kong plans more regulated stablecoin uses

The stablecoin proposals follow the introduction of Hong Kong’s regulated issuer framework and the first licenses granted earlier this year.

As crypto.news previously reported, the city’s first stablecoin issuer licenses went to two institutions with banking backgrounds in April. The framework requires licensed issuers to maintain eligible reserve assets and remain under ongoing regulatory supervision.

One of the licensed issuers, Standard Chartered backed Anchorpoint Financial, has since started rolling out its Hong Kong dollar backed HKDAP stablecoin.

Anchorpoint opened HKDAP beta access in August for institutional distributors and professional investors. The stablecoin initially supports cross border payments, fiat conversion and settlement involving tokenized real world assets, with HashKey Exchange joining as an authorized distribution partner.

Standard Chartered became the first bank distributor for HKDAP later that month, providing eligible institutional clients and partners with access to the regulated token. The bank said it planned to introduce subscription and settlement services for tokenized money market funds during the fourth quarter of 2026.

Hong Kong’s new Policy Address extends that direction by calling for regulated stablecoins to be traded through licensed virtual asset trading platforms and used for tokenized money market fund settlement.

Tokenized gold and other assets could reach licensed platforms

Tokenization forms another part of the government’s financial market plans, with the SFC expected to improve the regulatory framework for tokenized investment products.

The proposed framework would facilitate the issuance and trading of tokenized gold and other suitable real world assets through licensed platforms, while providing room for new products.

Hong Kong had already set out a regulatory path covering exchanges, stablecoin issuers, dealers and custodians under its second digital asset policy statement in 2025. The framework included plans to support tokenized real world assets and examine legal changes needed for tokenized financial instruments.

Digital bonds have since become a larger part of the city’s tokenization activity. Between 2025 and the first half of 2026, digital bonds issued in Hong Kong accounted for nearly 50% of the global market, according to the Policy Address.

In June, the Hong Kong Mortgage Corporation priced a HK$12 billion digital bond, equivalent to roughly $1.5 billion. The corporation described the transaction as the world’s largest completed tokenized bond issuance, while orders reached around HK$24 billion from more than 100 institutional accounts.

The government now plans to regularize digital bond issuance and explore the use of digital currencies throughout the bonds’ life cycle, including settlement, dividend payments and redemption.

Tests involving tokenized Exchange Fund Bills are scheduled by the end of 2026. More than HK$1.3 trillion worth of Exchange Fund Bills could be used in the program as authorities examine round the clock applications of tokenization for banks’ asset and liability management.

The HKMA’s Tokenised Bond Expert Group will conduct a second phase legal review with the Financial Services and the Treasury Bureau to examine the application of distributed ledger technology in capital markets.

The group, formed earlier this year, includes JPMorgan Securities, HSBC, Standard Chartered Bank, UBS, Ant Digital and HashKey Group among its participants. It was established after Hong Kong had issued more than HK$6.8 billion in tokenized government bonds across multiple offerings.

CMU OmniClear Limited is expected to establish a digital asset platform during 2026 to provide services covering the issuance and settlement of digital bonds.

EnsembleTX targets 24 hour CBDC settlement

Hong Kong’s monetary authority is preparing another part of the settlement infrastructure around tokenized finance.

The HKMA plans to implement CBDC settlement and 24 hour operations under EnsembleTX around the end of 2026, while continuing to explore further applications for tokenized deposits.

Earlier government plans had placed EnsembleTX within Hong Kong’s work on wholesale CBDC infrastructure and tokenized deposits. The 2026 to 2027 Budget said authorities were developing digital asset regulation alongside tokenized bonds, stablecoins and market infrastructure.

The government intends to combine the expansion of those markets with tighter surveillance. The SFC is scheduled to begin operating a digital asset custody surveillance system during the second half of 2026, according to the Policy Address.

Its CrypTech initiative is expected to activate big data market surveillance and anti money laundering surveillance components in 2027. The HKMA has separately started a Quantum Preparedness Index intended to guide financial institutions as advances in quantum computing create a need to upgrade cryptographic systems.

The Celsius bankruptcy estate sued five BitMEX-linked companies, alleging fraud, market manipulation and wrongful liquidations during the March 2020 market crash. 

The complaint was filed on Sept. 12 in the US Bankruptcy Court for the Southern District of New York by Celsius entities acting through estate representative Blockchain Recovery Investment Consortium (BRIC). Defendants include HDR Global Trading, ABS Global Trading, Shine Effort, 100x Holdings and HDR Global Services.

The estate alleged that BitMEX wrongfully liquidated and seized 1,325.84 BTC in collateral from Celsius on March 12, 2020, and 5,034.33 BTC from investment fund JST the following day. JST subsequently assigned the related claims to the estate, according to the filing.

The lawsuit seeks the recovery of Bitcoin worth nearly $490 million at the time of writing, and was filed 11 days before BitMEX is scheduled to stop exchange services on Sept. 23.

Cointelegraph reached out to the Celsius estate and BitMEX for comment but did not receive a response before publication.

Celsius alleges BitMEX intensified 2020 sell-off

The Celsius estate alleges that BitMEX controlled the prices used to trigger liquidations, the engine that executed them and the insurance fund that received proceeds from some liquidated positions. 

According to the complaint, some liquidation sell orders were placed at prices more than 24% below the next-best ask available on the platform. It also alleges that Bitcoin traded at a lower price on BitMEX than on competing exchanges as the liquidation cycle intensified.

The estate cites the timing of BitMEX’s March 13, 2020, service disruption as evidence for its claim that the exchange’s liquidation engine intensified the sell-off. It alleges that liquidation orders stopped when the platform became unavailable, and Bitcoin’s price then recovered, indicating, in the estate’s view, that forced selling on BitMEX had been suppressing the price.

On March 16, 2020, BitMEX said it experienced two distributed denial-of-service attacks on March 13, at 02:16 UTC and 12:56 UTC.

The estate is seeking actual damages of at least 6,360.16 BTC or its current value, along with the return of the Bitcoin in kind or its equivalent market value. The complaint also requests statutory damages, punitive and any applicable treble damages, profits BitMEX allegedly earned from the liquidations, and legal fees and costs.

The filing does not quantify the additional claims, saying the amounts should be determined at trial.

Related: BitMEX delists 65 trading pairs, derivatives in July amid exchange shutdown

On July 23, BKX Services and David Namdar filed a separate proposed class action, alleging they lost a combined 622.66 BTC through forced liquidations. That complaint alleged an internal trading desk could access private customer information and continue trading during server freezes.

Responding to the July case, a BitMEX spokesperson told Cointelegraph that it was an “opportunistic claim with no basis” and said the company would vigorously defend itself. The statement concerned the July lawsuit and was not a response to the Celsius complaint.

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it