STKR News0 of 3 free this monthNEAR's Illia Polosukhin warns that AI-driven exploits are now faster than human reviews. Builders need formal verification to survive an era where software hacks itself.
Originally on The Block →Adrian Boysel
Contributor
Jul 20, 2026
5 min read
Photo illustration / STKR News
We have long treated software security as a process of catch-up. A developer writes code, a third-party auditor finds the obvious holes, and we ship it with a prayer that the bounty hunters are friendlier than the exploiters. But according to NEAR co-founder Illia Polosukhin, that model is effectively dead. The reason is simple: AI is getting significantly better at breaking things than we are at checking them.
For anyone building in crypto or decentralized infrastructure, this isn't just a technical hurdle. It is an existential shift. We are moving from a world where hackers are humans using tools, to a world where AI is the hacker, operating at a scale and speed that no manual code review can possibly match. If your security strategy still relies on three guys in a Zoom room looking at a smart contract, you are already behind.
Security has always been asymmetrical. An attacker only needs to find one flaw; a developer needs to fix all of them. AI exacerbates this gap to an extreme degree. Large Language Models (LLMs) and specialized agents are now capable of scanning entire codebases, identifying logical inconsistencies, and drafting exploit payloads in seconds. They don't get tired, they don't miss commas, and they work for pennies.
Polosukhin’s point, which he shared recently, is that our current defense mechanism—traditional code reviews—is inherently human-speed. Humans are slow. We take weeks to schedule an audit, and the output is often a PDF that becomes outdated the moment the next patch is pushed. Meanwhile, an AI-assisted hacker can iterate through thousands of attack vectors while the developer is still at lunch.
Most founders treat audits as a checkbox for investors or a marketing badge. “We are audited by X firm” is supposed to mean the code is safe. But we’ve seen dozens of audited protocols drained within months of launch. The issue isn’t necessarily that the auditors are bad at their jobs; it’s that the job itself has become impossible to perform manually.
Manual reviews are prone to bias and fatigue. When you're looking at 10,000 lines of Rust or Solidity, you start to see what you expect to see, not what is actually there. AI, on the other hand, can be trained to look for specific patterns of failure across millions of previous exploits. It doesn't have a “gut feeling”; it has data. And right now, the data is favoring the attackers.
If AI is the weapon, then formal verification is the shield. For the uninitiated, formal verification is the process of using mathematical proofs to ensure that a piece of software works exactly as intended under every possible condition. It moves code security from “we think this works” to “we can prove this follows these rules.”
Polosukhin argues that this is no longer a luxury for high-value protocols; it is a necessity for anything entering the public domain. If we don’t mathematically prove our code is sound, an AI will mathematically prove it is not. The challenge is that formal verification is traditionally difficult to implement. It requires specialized knowledge and can slow down the development lifecycle. But the trade-off—spending more time on the front end to avoid a total collapse on the back end—is becoming a non-negotiable bargain.
As a founder, you have to look at your tech stack through a new lens. You aren’t just building for users; you are building for an adversarial environment where the adversary is an automated agent. This changes three things about how you should build:
We are entering a period where the security of our financial systems and data will depend on which AI is more sophisticated: the one writing the code or the one trying to break it. Polosukhin’s warning is a wake-up call for the entire Web3 space. We cannot rely on the old ways of doing things because the old ways were built for a world where the speed of thought was the limiting factor.
The limiting factor now is compute. An attacker with enough GPUs can find the edge cases you didn't even know existed. In this environment, human intuition is a liability. We need systems that are secure by design, not secure by consensus or secure by reputation.
While the NEAR co-founder is right about the threat, we should be careful not to view AI-driven security tools as a magic bullet. Just as AI can make mistakes in writing code (hallucinations), it can make mistakes in verifying it. A “verified” flag on a dashboard is only as good as the parameters the developer set for that verification. If you prove the wrong thing, you’re still vulnerable.
The builder-first approach isn't about blindly trusting automated tools; it’s about using them to augment our capacity to be rigorous. We shouldn't stop at formal verification; we should combine it with sound economic design and modularity so that if one part of the system is breached, the rest remains intact.
“Formal verification is a necessary shift for securing blockchain code from AI hacking.”
The era of the human auditor is ending, and the era of the machine prover has begun. For builders, the message is clear: if you aren’t using formal methods to secure your code, you are leaving the door unlocked for a thief who never sleeps. It is time to treat security as a math problem, not a management problem. AI is already scanning your repo. The question is, what will it find first: a proof or a payday?
Read the original at The Block →
A six-minute morning dispatch on the markets and the technology shaping them.
Free. No spam. Unsubscribe anytime.
Earn $STKR for published stories on markets, protocols, and culture.
Comments
24 reader responses
