Next Two Years Will Be About Survival, Not Winning for Crypto Exchanges: Vitalik Buterin Warns Amid Rising Hacks

Ethereum co-founder Vitalik Buterin has warned that the next two years could be a fight for survival for cryptocurrency exchanges, rather than a race to capture market share. Speaking in an exclusive interview with Moneycontrol, he said exchanges, custodians and crypto institutions must prioritise security as major hacks increasingly target user interfaces and centralised infrastructure.

His warning comes amid a series of high-profile cryptocurrency thefts, including the reported $1.5 billion Bybit breach in 2025 and a much larger $6.3 billion Binance incident reported in November 2026. Buterin believes the industry must adopt a defensive approach, strengthen account security and reduce reliance on vulnerable centralised systems before regulators impose stricter obligations.

Vitalik Buterin Calls for ‘Bunker Mode’

Buterin said crypto companies are increasingly recognising that their primary responsibility over the next two years is not to outperform competitors but to ensure they can continue operating securely.

He described this shift as entering “bunker mode”, a defensive strategy in which exchanges and custodians concentrate on protecting customer assets, securing their infrastructure and reducing exposure to cyberattacks.

The warning reflects a changing threat environment. Cryptocurrency platforms have become larger, hold substantial customer assets and increasingly serve institutional investors. That makes them attractive targets for sophisticated cybercriminal groups.

Buterin expects major exchanges, including Binance, to adopt stronger defensive measures. He also believes custodians and other financial institutions dealing with digital assets will need to rethink how they protect customer funds.

The message is significant for an industry that has traditionally competed on trading volumes, product launches, token listings and customer acquisition. Buterin’s argument is that growth becomes meaningless if a security failure can wipe out customer assets and damage confidence in the platform.

Major Crypto Hacks Are Changing the Security Debate

The warning follows several major security incidents that have shaken confidence in cryptocurrency platforms.

In February 2025, Bybit suffered a security breach involving approximately $1.5 billion in digital assets. The attack was widely attributed to North Korean-linked hackers and exposed vulnerabilities in the systems used to manage cryptocurrency transactions.

More recently, a reported $6.3 billion Binance heist in November 2026 has intensified concerns across the industry. The incident triggered discussions about exchange security, information sharing and the ability of platforms to respond quickly when suspicious transactions occur.

According to Reuters, crypto exchanges have been reviewing their security arrangements following the Binance incident. Industry participants have called for faster information sharing to help identify and respond to attacks before stolen assets move through multiple platforms.

These incidents demonstrate that even large, well-funded cryptocurrency companies can face sophisticated attacks.

For investors, the consequences can extend beyond temporary trading disruptions. A successful attack can result in permanent asset losses, withdrawal restrictions and uncertainty about whether customers will receive compensation.

Hackers Are Targeting Centralised Components, Not Just Blockchains

One of Buterin’s most important observations concerns the changing nature of cryptocurrency attacks.

He said the biggest hacks over roughly the previous 18 months have increasingly exploited weaknesses in user interfaces and centralised components rather than vulnerabilities in the underlying blockchain technology.

This distinction matters because blockchain networks and cryptocurrency platforms are not the same thing.

A blockchain is the underlying network that records transactions and maintains a shared ledger. An exchange, meanwhile, provides an interface through which users buy, sell, store or transfer digital assets.

Even when the blockchain itself operates correctly, weaknesses in account management systems, software interfaces, employee access controls or transaction approval processes can expose customer funds.

Buterin said the number of things that users can do securely on blockchain networks is increasing. He also pointed out that smart contract hacks have declined significantly, suggesting that improvements in blockchain security are producing results.

However, centralised services remain an important vulnerability.

This means crypto companies cannot rely only on the security of the blockchain. They must also protect the software, operational processes and human-controlled systems that connect customers to digital assets.

Why Buterin Wants Regulators to Hold Exchanges Accountable

Buterin warned that continued hacking incidents could eventually force regulators to intervene more aggressively.

He believes authorities may begin requiring cryptocurrency companies to operate more conservatively and take greater responsibility for protecting customer assets.

His argument is that when exchanges repeatedly lose funds to sophisticated cybercriminal groups, the industry cannot treat those incidents as unavoidable technical failures.

Buterin made a particularly strong point about funds stolen by North Korean hackers, arguing that allowing repeated thefts to continue could effectively amount to financially supporting the country.

He expects regulators to increasingly push companies towards stronger security standards and more cautious operational practices.

The comments come as governments worldwide are examining how cryptocurrency platforms should be supervised, particularly as traditional financial institutions become more involved in digital assets.

However, Buterin also cautioned against imposing identical regulatory frameworks everywhere. He argued that global regulation should preserve diversity and allow different jurisdictions to experiment with different approaches.

In his view, regulation should focus more heavily on activities that create risks for other people, rather than treating every crypto-related activity in the same way.

Multi-Signature Wallets and Stronger Account Protection

Buterin also highlighted practical security measures that cryptocurrency companies and large investors should consider.

One of his recommendations was to use multi-signature wallets, commonly called multisig wallets.

A conventional cryptocurrency wallet can allow a single private key to authorise transactions. If that key is stolen, an attacker may be able to transfer the assets.

A multisig wallet requires approvals from multiple keys before a transaction can be completed. For example, a wallet could require two out of three authorised signatories to approve a transfer.

This reduces the risk that a single compromised account or device can result in the loss of all the funds.

For exchanges and institutional custodians, such systems can provide an additional layer of protection by separating transaction approval responsibilities.

Other important safeguards include stronger authentication, secure employee access, transaction monitoring, regular security audits and clear emergency procedures.

Buterin’s broader message is that security must become part of the operating model rather than an additional feature introduced after an attack.

AI Could Accelerate Ethereum’s Security Transformation

Beyond the immediate threat to exchanges, Buterin discussed how artificial intelligence could change Ethereum’s development process.

He highlighted Ethereum’s ongoing Lean Ethereum roadmap, which aims to make the network more efficient, capable and secure while preserving decentralisation.

The roadmap involves technologies such as zero-knowledge proofs, AI-assisted development and formal verification.

Formal verification is a method of mathematically checking whether software behaves according to specified rules. It can help developers identify errors and vulnerabilities before code is deployed.

Buterin said AI and formal verification could dramatically accelerate Ethereum’s technical progress. Work that might previously have taken decades could potentially be completed much faster using newer tools and development methods.

However, AI also creates new security challenges. As AI systems become better at analysing code and discovering weaknesses, attackers may also use them to identify vulnerabilities more quickly.

The challenge for blockchain developers will be to use AI to strengthen security while ensuring that the resulting systems remain reliable and decentralised.

Buterin Says Ethereum’s India Growth Depends on Developers

During the interview, Buterin also discussed Ethereum’s growing developer community in India.

He said the country’s young developer population is increasingly interested in building meaningful applications rather than focusing exclusively on cryptocurrency tokens and speculative projects.

He highlighted growing interest in prediction markets, privacy technologies, proof-of-personhood systems and applications connected to India’s digital public infrastructure.

Prediction markets allow participants to trade contracts based on the outcomes of future events. Buterin noted that many decentralised finance applications can also be understood as specialised forms of prediction markets.

He also pointed to the potential for blockchain technology to support applications involving identity, privacy and public infrastructure.

On Ethereum’s expansion strategy in India, Buterin said the Ethereum Foundation intends to provide technical support where it can improve security, privacy and openness. However, he believes the responsibility for driving adoption ultimately rests with Indian developers and the local community.

Layer 2 Networks Must Offer More Than Ethereum Scaling

Buterin also expressed a clear preference for Layer 2 blockchain networks that offer capabilities beyond simply copying Ethereum and making transactions cheaper.

Layer 2 networks are built on top of a primary blockchain to improve transaction speed, reduce costs or introduce additional functionality.

He argued that projects that only replicate Ethereum’s existing features are less interesting. Instead, Layer 2 networks should develop specialised applications that Ethereum does not provide directly.

He identified high-performance decentralised finance and privacy-focused protocols as important areas of innovation.

Buterin also discussed enterprise applications, where companies could use blockchain networks to record proofs of changes to supply chains, health records and manufacturing information without necessarily publishing all underlying data.

The broader direction is towards a blockchain ecosystem in which different networks provide specialised services while maintaining security and interoperability with Ethereum.

The Bigger Picture

Buterin’s warning reflects a turning point for the cryptocurrency industry. For years, exchanges competed aggressively for customers, trading volumes and market share. But repeated security failures are forcing the industry to reconsider its priorities.

The growing involvement of institutional investors and traditional financial companies makes the issue even more important. As digital assets become more closely connected to mainstream finance, security failures could affect not only individual crypto users but also broader financial institutions and market confidence.

The next phase of competition may therefore be determined less by the number of tokens listed or trading features offered and more by how reliably platforms protect customer assets. Exchanges that fail to strengthen their security systems could face financial losses, regulatory pressure and a loss of customer trust.

Looking Ahead

Over the next two years, cryptocurrency exchanges are likely to face increasing pressure to strengthen custody arrangements, improve transaction monitoring and reduce dependence on vulnerable centralised systems. The latest hacking incidents could accelerate collaboration between exchanges, cybersecurity firms and regulators. Buterin’s comments suggest that companies will need to treat security as a fundamental business requirement rather than a secondary operational concern.

For Ethereum, the focus will remain on improving the network’s performance and security through technologies such as zero-knowledge proofs, AI-assisted development and formal verification. The industry is also likely to see more specialised Layer 2 applications and greater institutional participation in decentralised finance. However, the long-term success of crypto will depend on whether its infrastructure can become secure enough to support mainstream financial activity without sacrificing the openness and decentralisation that underpin blockchain technology.