AI poses greater threat to Bitcoin than quantum computing, Swan founder says

We have spent the last decade arguing about when quantum computing will finally get powerful enough to crack the elliptic curve cryptography that protects the Bitcoin network. It is a favorite topic for critics and academics who like to project fear into a ten-year horizon. But while we are looking at the distant horizon for a hypothetical supercomputer, there is a much more immediate fire burning in the backyard. That fire is artificial intelligence, and it is being used by attackers right now.

Cory Klippsten, the founder of Swan Bitcoin, recently pointed out something that most founders in the space have been feeling intuitively: Large Language Models (LLMs) are becoming the ultimate toolkit for malicious actors. We are no longer talking about a script kiddie trying to guess a password. We are talking about automated systems capable of finding needles in haystacks of code and manipulating the weakest link in any security chain—the human being behind the screen.

The Proximity of the Threat

The reason this matters for builders is simple. Quantum computing is a hardware problem that requires massive cooling, billions in investment, and fundamental breakthroughs in physics to reach a scale where it could threaten a private key. AI, conversely, is a software problem that has already been solved and distributed to millions of people for free. A hacker does not need a lab in Switzerland; they just need a clever prompt and an API key.

When we look at the attack surface of the crypto ecosystem, we usually think about the protocol level. We assume the math is sound. And for the most part, it is. But a protocol is only as secure as the people who interact with it and the secondary applications built on top of it. AI is currently being used to scan smart contracts for logic errors at a speed no human auditor could ever match. More importantly, it is being used to craft social engineering attacks that are becoming nearly impossible to detect.

The New Era of Social Engineering

For years, the red flags of a phishing attempt were obvious: broken English, weird formatting, or an urgent request from a "prince" in a far-off land. AI has deleted those red flags. Today, a generative model can scrape your LinkedIn, your Twitter feed, and your GitHub commits to craft a perfectly phrased email that sounds exactly like a colleague or a trusted partner. It can even mimic the specific technical jargon you use in your daily stand-ups.

If you are a founder, this is your primary risk. It is not that someone will brute-force the Bitcoin network; it is that someone will use an LLM to convince your lead dev to click a link that installs a keylogger or a malicious browser extension. The cost of running these attacks has dropped to near zero, while the sophistication has increased by orders of magnitude.

Code Auditing as a Double-Edged Sword

In the builder community, we have been praising AI for its ability to help us write code faster. We use Copilot to boilerplate our apps and ChatGPT to debug our scripts. But we have to realize that the same tool helping you build your bridge is also helping the guy trying to blow it up. Hackers are feeding entire codebases into LLMs and asking them to find "unintended state transitions" or "reentrancy vulnerabilities."

This creates an arms race. If you aren't using AI to audit your own code before you ship, you are effectively leaving your front door unlocked in a neighborhood where everyone else has a master key. The speed at which an exploit can be found and weaponized is now measured in seconds, not days. By the time a human auditor catches a bug, an automated bot might have already drained the treasury.

Why Quantum is a Distraction

The obsession with quantum computing often serves as a form of intellectual escapism. It is easier to talk about "Shor's algorithm" and theoretical physics than it is to admit that our current operational security is failing. Bitcoin is actually remarkably resilient to quantum threats because the community has already discussed soft-forking to quantum-resistant signatures if it ever becomes necessary. The network has a path to upgrade.

However, there is no simple patch for a human being who gets tricked by a deepfake voice memo from their CEO. There is no soft-fork that can fix a developer who accidentally leaks an API key because an AI-powered bot tricked them into a fake technical interview. These are the "low-tech" high-impact attacks that AI excels at, and they are happening in real-time.

What Builders Should Do Now

If you are building in the Bitcoin or AI space, you need to stop worrying about 2035 and start worrying about tomorrow morning. The first step is acknowledging that any public-facing communication can be spoofed. We need to move toward a "zero-trust" architecture not just in our code, but in our company cultures.

• Verify out-of-band: If a request involves moving funds or changing security permissions, verify it through a second, unrelated channel.
• AI-driven defense: Use the same LLMs the hackers use to red-team your own infrastructure. If an AI can find a bug in your contract, fix it before you deploy.
• Hardware keys are mandatory: If you are still using SMS-based 2FA or even app-based codes, you are vulnerable to AI-powered interception. Physical security keys are the only way to effectively air-gap your identity.

The Reality Check

Bitcoin itself is a fortress, but the bridges we build to reach that fortress are often made of wood. AI is giving every attacker a flamethrower. While the headlines focus on the theoretical end of cryptography, the practical reality is that we are losing the battle on the social and application layers. As founders, our job isn't just to write code; it is to build systems that assume every piece of incoming information might be a sophisticated fabrication.

The threat isn't a smarter computer; it's a computer that is just smart enough to trick a human. That is the hurdle we have to clear today.

Read the original at Cointelegraph →