Ethereum co-founder Vitalik Buterin gave a harsh assessment of the prospects for centralized crypto exchanges: in the next two years they will have to fight for survival, not for market leadership. For the platforms' clients, this is a direct risk signal — funds are increasingly leaking through vulnerable interfaces and centralized systems, and new attacks could result in stricter regulatory requirements.
According to Buterin, exchanges and cryptocurrency storage services should shift to a defensive strategy. At the same time, Ethereum retains its leadership in DeFi, where the safety of investments matters more to investors than an extra percentage point of yield.
Hackers have changed their target
Buterin noted that smart contract exploits have become far less common — which is good news. However, all major attacks over the past year and a half have targeted user interfaces and centralized components. In other words, attackers are looking for weak points not in blockchain code, but in companies' infrastructure through which users store and transfer money.
The attacks on Bybit and Binance were carried out remotely and are linked to hackers from the DPRK. The only long-term solution, according to Buterin, is to make systems truly secure. If hacks become a more serious problem, regulators will start holding companies accountable and demanding greater caution from them. For exchanges, this could mean that losses from theft will be compounded by claims from supervisory authorities.
Ethereum's bet on security
Speaking about the convergence of traditional finance and DeFi, Buterin emphasized that Ethereum leads in the large-sum segment, where reliability and a conservative approach are paramount. The point is not the difference between 4% and 5% annual yield, but minimizing the chance of losing 100% of one's investment.
According to Buterin, zero-knowledge proofs (ZK), artificial intelligence, and formal verification will help advance Lean Ethereum — a plan to simplify the network's protocol. Formal verification is a mathematical check that code works exactly as intended, while ZK proofs allow data to be confirmed without revealing it.
Buterin advises layer-2 networks (L2) that offload Ethereum not to duplicate the main network's scaling. He named high-performance DeFi, privacy, and enterprise solutions as promising directions.
Lessons from the Binance hack
Buterin's thesis about centralized components aligns with Haipo Yang's analysis of the $6.34 billion Binance hack. According to the founder of ViaBTC and CoinEx, the exchange made three basic mistakes: it did not separate employees' work computers from money management systems, it left a single key for login without a second factor, and it took a formal approach to multisignature.
The attack also affected Ethereum: Binance head Richard Teng said that hackers used the EIP-7702 upgrade and continued moving funds even after the exchange suspended withdrawals. There are no vulnerabilities in the feature itself, according to Ethlabs researcher Derek Chiang, and the attackers reached the transaction signing system through the exchange's internal AI tools.
On-chain researcher SomaXBT found that the stolen funds are almost automatically laundered by a bot: within minutes it moves the money through new wallets and the Jupiter Lend shared credit pool, and there is no time to freeze them. DeFi, which Buterin is betting on for security, is also affected: open services risk unwittingly becoming a link in a criminal scheme.
Cryptalist analysis: Buterin's statement captures a fundamental shift in the crypto market's threat model: the attack vector has moved from protocols to the operational infrastructure of intermediaries, which calls into question the very economics of centralized platforms. For institutional capital, this strengthens the case for non-custodial solutions and segments with formal code verification, while exchanges will have to reconsider security and compliance budgets as a key survival factor.