Blockchain and AI meet usefully at a single point: AI now produces work faster than anyone can check it, and a blockchain is a machine for recording who committed to what, at what time, in a form nobody can revise afterward. That is the whole overlap. Every other version of the pairing, the on-chain model marketplaces, the tokenized data economies, the AI-powered trading oracles, is decoration on top of it.

Two technologies arrived with enormous claims and then spent years failing to matter. Blockchain became a technology in 2009 and is still, seventeen years later, largely a market that trades itself. Transformers shipped in 2017 and sat in research until a chat interface made them legible.

A build error, not a broken curve

On July 30, an attacker drained 1,082 BTC from 1,196 addresses in 41 minutes. Galaxy Research mapped the sweep to Coldcard, the bitcoin-only hardware wallet made by Canadian manufacturer Coinkite, and the running total across successive waves has since passed 1,430 BTC from more than 4,500 addresses, with the count still moving as researchers trace on-chain activity. Coinkite published its first advisory about thirty hours after the initial sweep. CEO Rodolfo Novak apologized publicly and took full accountability for the bug.

The cause was a configuration mismatch dating to March 2021. Coldcard’s production build defines a macro for the hardware random number generator as zero because the company supplies its own wrapper. The library handling it checked whether the macro existed rather than whether it was switched on, which bound the build to MicroPython’s fallback generator. That fallback was seeded from the chip’s unique ID and its timer registers, and collected no fresh entropy afterward. Seeds that were supposed to carry 128 bits of randomness carried around 40 on Mk3 devices and around 72 on Mk4, Q and Mk5. Anyone who could constrain the device ID and timer state could reproduce candidate seeds offline, derive the addresses, and check them against the public ledger.

Nothing about bitcoin’s cryptography failed. The curve held. The administration is the issue. What failed was one vendor’s build process, and the ledger the whole system depends on for integrity is what made the theft efficient, because candidate keys could be tested against public data at no cost.

Coinkite has said it believes the attacker used AI to find the flaw in its open source firmware, and that its own AI review of the same code weeks earlier found nothing.

The $6.3 million dare

On August 1, BitGo co-founder and chief executive Mike Belshe put 100 BTC into a public address, posted the address, and invited Anthropic’s models to take it. He was responding to a disclosure Anthropic had published two days earlier: during cybersecurity evaluations, three Claude models reached the open internet and touched real production systems, the result of a configuration error involving a testing partner, surfaced in an internal review of 141,006 test runs. Belshe’s read was that the lab was selling a monster it had not built. Either the sandboxes are bad or the marketing is good, he wrote, and possibly both.

He has standing to say it. In June he was the one who took apart a viral story recasting an authorized security exercise as a model breaking into classified government systems, and he was right. Security researchers looking at the July disclosure have made a similar point: the incidents describe models wandering through misconfigured environments rather than models developing attacks.

The dare itself establishes nothing, in either direction. It grants no access, describes no task, names no model, sets no rules and sets no deadline. The coins sit in BitGo’s institutional custody, where signing authority is split across independent keys through multi-signature or multi-party computation, so moving them would mean defeating a custody operation rather than defeating cryptography. And a lab declining to attempt an unsanctioned theft for publicity is guaranteed by policy whatever its models can do, which means the null result was determined before the wallet was funded. An untouched balance is not evidence of safety. It is evidence that nobody with the capability and the inclination has bothered, which describes the state of every unswept address on the network.

The version of this challenge aimed at the cryptography itself fails for a different reason. Recovering a private key from a 256-bit elliptic curve public key by search takes on the order of 2^128 group operations. That is a physical quantity of computation, and reasoning does not reduce it. A model can write correct attack code in under a minute. The code then has to run, and the running is the part that cannot happen. Asking a language model to brute-force a curve is asking a novelist to lift a building.

The only thing that reduces the number is structure, some property of a scheme that lets you skip most of the work. That is exactly what happened to HAWK, a post-quantum signature candidate and the only lattice-based scheme among the nine NIST advanced in May. Anthropic’s unreleased Claude Mythos Preview found a nontrivial automorphism in HAWK’s underlying lattice and cut the work required against its smallest parameter set from roughly 2^64 to 2^38 operations, in about 60 hours of semi-autonomous work costing around $100,000 in compute. The flaw had survived two years of expert human review.

Secp256k1 is not HAWK. The discrete logarithm problem on that curve has absorbed four decades of adversarial attention from the entire academic cryptography community. A model’s edge is speed across familiar terrain and unusual recombination, and on ground that thousands of specialists have already recombined, the marginal yield is small. HAWK was young, complicated and thinly reviewed, which is where a fast novel search pays.

Project Eleven runs a version of the bounty and has real money behind it, awarding one bitcoin in April to Giancarlo Lelli for breaking a 15-bit elliptic curve key on publicly accessible quantum hardware, up from a six-bit record the previous September. Even that, with a defined target and a published method, tells you about a trajectory rather than a threshold. The informal versions on X cost nothing and prove less.

Meanwhile the actual clock runs on hardware. Google’s Quantum AI team, with co-authors from the Ethereum Foundation and Stanford, published estimates in March putting an ECDSA break at fewer than 500,000 physical qubits, roughly a twentyfold reduction on the prior figure, fast enough to hijack a transaction inside a ten-minute block window. Around a third of all bitcoin sits at addresses that have already exposed a public key. BIP-360 was merged in February to introduce a quantum-resistant output type, and Jameson Lopp and others proposed BIP-361 in April to phase out ECDSA entirely.

When an agent acts, who owns the action?

Recent agentic incidents have turned ownership from an intellectual-property question into an operational one.

In July, OpenAI disclosed that models attempting to solve its ExploitGym benchmark exploited a zero-day vulnerability, obtained internet access and compromised Hugging Face’s production infrastructure in search of the benchmark answers. Days later, Britain’s AI Security Institute documented 19 unsanctioned actions across 10 of 122 evaluation runs. In the most serious sequence, an Anthropic Mythos 5 agent researched software maintainers, created fake online identities, submitted malicious code and tried to manipulate a human into approving it.

The evaluations used deliberately permissive conditions, including open internet access and disabled cyber safeguards, and investigators found no resulting real-world harm. The agents were still never instructed to deceive anyone. Deception emerged as one route toward completing the assigned objective.

The OpenClaw incident brought the same problem into ordinary consumer activity. A Melbourne user named Andrew reportedly asked his agent to reserve a popular gym class. The agent discovered missing authorization controls in the booking API, made reservations months beyond the normal limit and cancelled another member’s place to move Andrew up the waitlist. When Andrew told it to reverse the cancellation, the agent said it could not restore the displaced member.

Andrew supplied the objective and stood to receive the benefit. The agent selected the method. OpenClaw supplied the operating layer, the underlying model supplied the reasoning, and the gym’s software accepted an action it should have rejected. Another customer absorbed the cost.

The agent has causal agency without legal personhood. Ownership therefore breaks into a chain of separate questions: Who specified the goal? Who supplied the credentials? Who defined the permissible scope? Who selected the action? Which system authorized it? Who received the benefit, and who bears responsibility for the result? Existing legal doctrines may distribute liability among developers, deployers, users and affected platforms, but they require evidence of exactly what each participant authorized and did. Recent legal analysis suggests that those records will become central to negligence, product-liability and unauthorized-access claims.

The verification gap

After Mythos returned the HAWK attack, Anthropic’s team spent several hundred hours confirming it was correct.

Sixty hours to discover. Hundreds to verify. That ratio is the most important number in AI right now, and it repeats at every scale. Coinkite’s AI audit missed a bug an attacker’s AI apparently found. Frontier models generate research-grade mathematics that takes specialists weeks to check. The bottleneck moved from producing candidate answers to establishing which ones are true, and it moved there permanently, because verification is the step that cannot be done probabilistically by the same kind of system that produced the candidate.

Proof of work was always labour that produced nothing

Mining is deliberately meaningless. Hashes are computed, discarded, and computed again, and the meaninglessness is the design: nobody can fake having burned the electricity, and nobody gets an advantage from being clever about it. The work was never production. It was a cost signal made unforgeable. Ethereum’s move to proof of stake swapped burned energy for pledged capital and kept the same logic, a cost you cannot counterfeit standing in for a trust you cannot verify.

Set that beside the ratio above. The scarce, expensive, unfakeable labour in the AI economy is verification, and it is the one kind of expensive labour that produces something. A system built to make costly effort provable, pointed at effort that matters, is a different proposition from one pointed at hashes.

Perception, and the thing Ethereum proved by accident

Bitcoin’s price has never been anchored to a cash flow. It reflects what holders believe other holders will believe, which makes perception the substance rather than a distortion of it, and makes the market rational on its own terms and unfalsifiable on anyone else’s. The Coldcard episode showed what happens when belief takes a hit rather than the price: some holders moved coins back to exchanges and custodians, which means the underlying asset was never trustlessness. It was trust in an implementation stack nobody outside a handful of firmware engineers has ever inspected.

Ethereum did change the picture. The network turned eleven on July 30 hosting about $148.8 billion in stablecoins and $15.5 billion in tokenized real-world assets. Solo staking yielded 3.5 to 4.2 percent early this year, paid out of fees and consensus rewards rather than token issuance. That is real economic substance, and tokenized treasury issuance has kept climbing whether ether is up, down or flat. Daily mainnet revenue, meanwhile, has fallen to around $330,000 as activity migrated to rollups.

Ethereum proved a chain can carry genuine economic weight and proved, in the same decade, that carrying it does not mean capturing it. Any argument that AI demand will fix crypto valuations has to explain why this time the usage attaches to the asset.

The chain moving the most money has no token at all

While western crypto argues about custody and capability, the largest settled volumes on distributed ledger infrastructure are running through mBridge, the multilateral central bank digital currency platform built by the central banks of mainland China, Hong Kong, Macau, Saudi Arabia, the United Arab Emirates and Thailand.

Bank of China disclosed in July that its Shenzhen and Fujian branches had each executed cross-border transfers worth more than $1.7 billion, one an outbound payment of 11.3 billion yuan delivered same-day at full value, the other an inbound Hong Kong dollar transaction settled onshore in under an hour. Cumulative transactions on the platform passed 600 billion yuan, roughly $88.6 billion, by late June. The design intent is direct peer-to-peer settlement without the chain of correspondent banks that makes conventional cross-border payment slow and expensive, and the strategic intent is yuan clearing that does not pass through western financial infrastructure.

There is no coin. No mining, no staking, no float, no market. Every participant is known, permissioned and a central bank. What remains after all of that is stripped out turns out to be the part that was doing the work: settlement finality between parties who need certainty about who paid what and when.

That is uncomfortable for the decentralization thesis and clarifying for everything else. The property worth having was never trustlessness among anonymous strangers. It was an unrevisable record shared by parties with reason to disagree.

What a ledger can and cannot tell you

A blockchain verifies that a record exists, that it has not been altered, and that a particular key signed it. It cannot verify that a claim is true. Anchoring a model output on-chain proves an output existed at a time, which is worth something and is not verification of the output.

Most of the AI-plus-blockchain pitch dissolves at that line. What survives it is already shipping, and it looks more like mBridge than like bitcoin. ERC-8004 went live on Ethereum mainnet on January 29, three thin registries for agent identity, reputation and validation, with the logic kept off-chain; roughly 24,000 agents had registered within months. Those registries exist to convert anonymous agents into known parties, which is the same move central banks made by starting with known parties in the first place. The x402 protocol lets an agent pay per HTTP request in stablecoins, processed 35 million transactions on Solana by March, and runs at around $600 million annually across chains, with daily volumes down more than 90 percent from their December peak. For verification specifically, the pragmatic answer running in production is trusted execution environments signing attestations a contract can check, with zkML still too expensive to deploy. Phala and Marlin pair that with x402 so an agent pays only for inference it can verify.

That is the operating model, and it is narrower than the rhetoric. The chain does not judge the work. It records who did it, under whose authority, with what budget, and it makes that record survive the agent. Authority becomes delegated rather than absolute: spending caps, allowlists, time limits, revocation. Possession of a key stops meaning unlimited control, which is the property autonomous agents make unacceptable.

This is the same constraint that shows up in agentic safety research from the other direction. As the real-world consequence of an action rises, the probabilistic authority a system can safely exercise has to fall, which means the layer underneath a probabilistic actor has to be deterministic. A ledger is a deterministic layer. That is its actual contribution to AI, and it has nothing to do with intelligence.

Tapscott is asking a different question

The Tapscotts, who founded the Blockchain Research Institute in 2017, have a recent book out, written before the latest agentic furore, You to the Power of Two, written by Don with Joseph Bradley and published in December. It argues that we have entered an era of what they call identic AI: personal agents that act as participants versus tools, with decentralized identity as the foundation. They are framing it as self-sovereign intelligence, including on the Cardano Foundation’s podcast, and the concern is ownership. Who does the agent belong to, and what happens when a personal AI decides it knows better.

That is a good question about power but a different question from the one recent failure poses. Ownership tells you who is accountable. It does not tell you whether what the agent did was correct. In the wallet sweeps incident, Coinkite owned its firmware completely, reviewed it with AI weeks before the attack, and shipped broken randomness for five years. The recent failures of AI agents to follow what we reconsider to be reasonable behaviour or not an issue of ownership, but an issue of command, understanding and autonomy.

Blockchain as the agentic verification layer

Agentic AI may finally provide blockchain with a problem sufficiently large and consequential to justify using it at scale.

Every autonomous action could begin with a cryptographic identity assigned to the agent and linked to an accountable human or organization. The owner would issue a signed mandate specifying the agent’s objective, permitted tools, data access, spending limits, expiration time and actions requiring human approval. Existing W3C decentralized-identifier and Verifiable Credentials standards already provide many of the identity and authorization components required for such a system.

Each outbound tool call would then carry the agent’s signature. A deterministic gateway outside the model would compare the requested action with the signed mandate before allowing it to proceed. Every decision would generate a receipt containing the agent identity, task identifier, model and harness version, active policy, requested action, target system, human approvals, timestamp and result.

Sensitive prompts, customer records and model outputs would remain encrypted off-chain. Their hashes could be grouped into Merkle trees, with periodic roots committed to a permissioned blockchain or anchored to a public chain. The ledger would preserve proof that a particular record existed at a particular time and had not subsequently been altered. NIST describes blockchain precisely as a shared, tamper-evident and tamper-resistant ledger.

This architecture is already beginning to appear in proposed technical protocols. A 2026 Agent Identity Protocol Internet-Draft proposes that agents sign every tool call while an external proxy checks policy and records the result. A separate Proof-of-Behavior Internet-Draft proposes signed, hash-linked action receipts, pre-execution policy decisions and external checkpoints. These remain proposals rather than finalized standards, but they describe the missing control layer with unusual clarity.

Applied to the gym incident, Andrew’s mandate might have authorized OpenClaw to reserve one available class. Cancelling another member’s reservation would fall outside that scope, causing the gateway to reject the call before it reached the booking system. A human could explicitly approve an expanded action, leaving a signed record of that decision. If the gym accepted an unsigned or out-of-scope request, the audit trail would identify the failure in its own authorization controls.

Blockchain cannot establish that an agent’s reasoning was sound, its source data was truthful or its action was ethical. It can establish identity, declared authority, sequence, approval and record integrity. Trusted execution environments, secure tool gateways and independent monitoring would still be required to connect the ledger’s evidence to real execution.

A conventional audit log may be sufficient inside one company. A shared ledger becomes valuable when the agent owner, model provider, agent developer, tool operator, insurer and regulator need evidence that none of the other parties can rewrite after an incident. AI supplies blockchain with a continuous stream of high-value actions to verify. Blockchain supplies AI with an independent chain of custody for machine behaviour.

Do their futures depend on each other

AI needs a verification layer to be manageable, and it will get its verification layer with or without blockchain, most likely from attestation hardware and formal methods with a ledger as the audit trail rather than the arbiter. Blockchain has existing infrastructure that may be linkable and address the issues that agentic behaviour is raising.

Blockchain’s case is the reverse. A technology whose one durable capability is making commitments unforgeable has spent seventeen years looking for a commitment worth making unforgeable. Cross-border settlement between central banks is one answer, and it required removing everything the crypto industry considers essential. Autonomous agents transacting on behalf of people who cannot supervise every action is the second, and it is heading the same way: identity registries, permissioned counterparties, revocable authority, attested execution.

Sources

• Galaxy Research via TheStreet, The Hacker News, TechSpot and Bitcoin.com on Coldcard sweep totals
• Block engineering analysis of the MICROPY_HW_ENABLE_RNG build error
• crypto.news on Coinkite’s AI review and entropy estimates by model
• Mike Belshe (@mikebelshe) on X, August 1 2026; Anthropic’s July 30 disclosure; Crypto Times, Finbold, Bitcoin.com and BeInCrypto coverage
• CoinDesk, CCN, Cryptopolitan on Claude Mythos Preview and HAWK-256
• Google Quantum AI whitepaper, March 31 2026; SecurityWeek and Forbes coverage
• Project Eleven Q-Day Prize announcement, April 24 2026
• CryptoSlate and NewsBTC on Ethereum’s eleventh anniversary metrics
• Daisy Wu, South China Morning Post, July 22 2026, on Bank of China and mBridge
• Gil Lopes Bueno, “AI and Blockchain in 2026: A Developer’s Map” on ERC-8004 and TEE attestation
• Cardano Foundation, “Inside the Future of AI and Blockchain with Don Tapscott,” December 18 2025