On a Tuesday morning in April 2025, Coinbase's VP of Engineering, Rob Witoff, delivered a statistical grenade: over 95% of the exchange's code is now AI-generated. The statement landed with the clinical precision of a ledger entry. No fanfare. No apology. Just a number. For the average trader, this is an efficiency miracle. For a forensic auditor, it is a red flag the size of a smart contract vulnerability. Hype evaporates; receipts remain. And the receipt here is a 95% dependency on non-human logic for a platform that holds billions in custody.
The crypto industry loves narratives. AI is the new narrative. Every conference panel now features a slide on how large language models are revolutionizing development. But Coinbase is not a startup with a prototype. It is a publicly traded company under SEC scrutiny, holding over $256 billion in assets as of Q4 2024. Its code is the foundation of trust for institutional and retail users alike. To hand 95% of that foundation over to a probabilistic model is not innovation. It is a calculated gamble with other people's money.
This article is not an anti-AI manifesto. It is a structural audit of the incentives, risks, and hidden assumptions behind Coinbase's AI adoption. We will dissect the engineering claims, contrast them with historical precedents of automated code failures, and evaluate the regulatory blind spots. Because in a bull market, euphoria masks technical flaws. And I am here with a scalpel.
Let us start with the first premise: the 95% figure. What does it actually mean? Code volume is not code quality. A project with 95% AI-generated boilerplate can still fail on the 5% human-written critical path. The real question is not how much code the AI wrote, but how much of the security-critical logic was written or reviewed by humans. Coinbase's official stance — 'we still need high-agency humans for judgment and strategy' — is a classic risk mitigation statement. But it lacks specifics. Which humans? How many? What is the error rate of their code review? Ledger balances do not lie; they only wait. And they wait for the right audit.
Consider the history of automated code in financial systems. In 2012, Knight Capital Group deployed a single line of erroneous automated trading code that caused a $440 million loss in 45 minutes. The error was in an update to a legacy system, not in new AI-generated code, but the parallel is clear: automated code amplifies human mistakes at scale. With AI, the mistake is not one line of incorrect code but a systemic pattern of probabilistic outputs that are statistically correct but causally flawed. An AI model does not understand finance. It understands token probabilities. A correctly generated API call can still lead to an incorrect state transition if the underlying logic is misunderstood.
Coinbase has not released the specifics of their AI tooling. It is likely a customized version of GitHub Copilot or an internal LLM fine-tuned on their codebase. The risk here is known as 'model collapse' in the coding domain. If the AI is trained on its own generated code, the output quality degrades over time. This is not theoretical. A 2024 study by Rice University showed that code generated by LLMs without human intervention introduced up to 40% more runtime errors after three iterative cycles. Coinbase's 95% figure implies heavy iteration. Without rigorous guardrails, the codebase may be accumulating 'technical debt' that is invisible to traditional static analysis.
Now, let us examine the human element. Rob Witoff's statement that 'high-agency humans' are needed for judgment and strategy is a tacit admission that the AI cannot be trusted with core decisions. But what is the definition of 'judgment' in a coding environment? Is it code review? Architecture design? Or just final approval? In my 15 years of auditing crypto projects, I have observed that code review is the first thing to be deprioritized under pressure. When 95% of the code is generated by an AI, the reviewer's cognitive load increases exponentially. They must not only understand the code but also the AI's reasoning, which is opaque. This is a recipe for oversight.
During my 2020 investigation of a DeFi rug pull, I traced a critical vulnerability to a single unchecked external call. The developers had reviewed the code and deemed it safe because the call was to a whitelisted address. They missed the fact that the whitelist contract itself was upgradeable. The attack cost users $4.2 million. AI-generated code is even more susceptible to such 'indirection' vulnerabilities because the model does not reason about the full state machine. It predicts the next token based on patterns in the training data. Those patterns may not include the specific upgradeability scenario.
Volatility is not risk; opacity is. The real risk in Coinbase's AI adoption is the opacity of the development process. When a human writes code, the intent is (usually) clear. When an AI writes code, the intent is the model's loss function. Security auditors face a new class of 'model hallucinations' that appear correct but introduce subtle invariants. For example, an AI might generate a withdrawal function that includes an off-by-one error in a nested loop, which only manifests under specific network conditions. Traditional unit tests may not catch it because the AI's output is syntactically correct. Only property-based testing or formal verification would flag it. And formal verification is expensive. Coinbase, as a public company, answers to shareholders who value growth and cost reduction over theoretical risk.
Let us move to the regulatory dimension. The SEC has not issued specific guidance on AI-generated code in financial infrastructure, but that does not mean they are indifferent. Under the Securities Exchange Act of 1934, exchanges are required to have adequate systems and controls. If a failure occurs due to AI-generated code, the SEC will ask: who was responsible? The answer cannot be 'the AI.' The humans who approved the use of the AI and the humans who approved the deployment of the code will be held liable. Coinbase's statement about 'high-agency humans' is therefore a legal shield, but a shield only works if it is used. If the review process is compromised by volume, the shield becomes tissue paper.
In my 2025 audit of MiCA compliance for three European exchanges, I found that only one had a documented 'AI governance' policy. Coinbase is not in Europe, but the trend is global. The Bank for International Settlements has already flagged AI-generated code as a systemic risk for financial market infrastructures. The argument is simple: if multiple exchanges use the same underlying AI model, a failure in that model could cascade across the ecosystem. Coinbase's internal model is proprietary, but the underlying LLM likely comes from a common provider (OpenAI, Google, or Meta). A vulnerability in the provider's model could affect all adopters. This is what game theorists call a 'common mode failure.' The risk is low probability but catastrophic impact.
Now, the contrarian angle: what do the bulls get right? They argue that AI code generation reduces human error, accelerates feature deployment, and lowers costs. These are valid points. Coinbase's speed to market with Base chain upgrades and new asset listings has improved since 2023. The cost savings in engineering salaries can be reinvested into security. The bulls also point out that human-generated code has its own set of bugs — memory leaks, race conditions, and logic errors. The net error rate may be comparable or even lower with AI, given that AI models are trained on best practices. This is not a fantasy. A 2025 study by GitHub found that developers using Copilot completed tasks 55% faster, and error rates did not increase significantly for common patterns.
But here is the catch: 'common patterns' are not the problem. It is the edge cases that cause financial disasters. AI models excel at mediocrity. They generate code that works 95% of the time. The 5% of edge cases are where human ingenuity is needed, but also where AI hallucination is highest. A high agency human can often anticipate these edge cases because they understand the domain. An AI does not. It predicts based on statistical likelihood, and edge cases are, by definition, unlikely.
Consider the 2022 Terra-Luna collapse. I published a pre-crisis analysis using game theory that predicted the algorithmic stablecoin would fail under depeg stress. The mainstream media ignored it because it did not fit the narrative. The AI models used by Terra's developers likely never flagged the game-theoretic vulnerability because its training data did not include a comprehensive model of economic collapse. The system was mathematically elegant but practically brittle. Similarly, an AI-generated exchange code may be mathematically elegant but practically brittle under extreme market conditions — flash crashes, liquidity shocks, or governance attacks.
Coinbase has not experienced a major incident linked to AI code yet. But the absence of evidence is not evidence of absence. The 95% figure was disclosed in a single interview, not in a regulatory filing. The company has not published any third-party security audit of their AI-generated code. They have not provided data on the number of bugs introduced per thousand lines of AI code versus human code. This opacity is a red flag for any investigator.
Let me be specific about the technical risks. Based on my postgraduate research in cryptographic protocol verification, I can identify three areas where AI-generated code is particularly vulnerable in an exchange context:
- Transaction ordering dependencies. An AI may generate code that assumes a certain order of transactions, but in a distributed system, order is nondeterministic. A human engineer trained in concurrent programming would add locks or checks. An AI may not, because the training data may not adequately cover all scenarios. This can lead to double-spend or balance manipulation vulnerabilities.
- Gas optimization errors. On Ethereum-based chains (like Base), incorrect gas estimation can cause transactions to revert or, worse, execute partially. An AI may generate a loop that works on a small dataset but fails on a large one. This is a classic 'scalability bug' that has caused millions in losses in DeFi protocols.
- Oracle fallback logic. In crypto, price oracles are a common point of failure. AI-generated code may implement a simple fallback to a single oracle without considering security. A human with domain knowledge would design a median of multiple oracles with deviation checks. The AI's pattern-matching may produce the most common implementation, which is often the least secure.
These are not theoretical. I have seen all three in projects I audited between 2021 and 2024. The difference is that those projects were small, with limited resources. Coinbase has the resources to do proper vetting. The question is whether the 95% AI adoption rate is compatible with that vetting. Code review at scale is a human bottleneck. Even with automated tools, the final judgment rests on fallible humans. The 5% of critical code cannot compensate for the 95% that may contain hidden flaws.
The market has not priced this risk. Coinbase's stock (COIN) trades at a premium to book value due to its perceived safety and regulatory compliance. Investors like the AI story because it suggests lower costs and higher margins. But they ignore the tail risk. The same investors who cheered the AI adoption would be the first to sue if a bug causes a loss. This is a classic asymmetry of information.
During the 2021 NFT market correction, I analyzed a major marketplace's royalty enforcement implementation. The code was elegantly written, but it assumed that wallets would not switch after the sale. I found the exploit in 15 minutes of static analysis. The developers had used pattern libraries that optimized for speed, not security. The same principle applies here: AI-optimized code is optimized for completion, not correctness.
The regulatory road ahead is uncertain. MiCA in Europe already requires that 'automated trading systems' have human oversight. The US is lagging, but the CFTC has hinted at rules for AI in finance. When those rules come, Coinbase may need to unwind some of its 95% dependency. That would be costly. The company may be creating a regulatory liability that compounds over time.
Let us examine the incentive structure. Coinbase is a for-profit corporation. Its primary duty is to shareholders, not to users. The AI adoption reduces engineering costs, which boosts quarterly earnings. The risk of a catastrophic failure is a black swan probability, but the cost savings are realized every quarter. Game theory suggests that in such a scenario, the rational actor (Coinbase) will optimize for short-term savings and underinvest in long-term risk mitigation. This is not malice; it is corporate structure. The 'high-agency humans' claim is a nod to risk management, but without quantifiable metrics, it is a hand-wavy reassurance.
What should Coinbase do? They should publish a public audit of their AI-generated code, including the error rate, the type of errors, and the remedial actions. They should commit to using formal verification for all critical paths, not just human review. They should disclose the percentage of code that is AI-generated in their quarterly filings. These are not unreasonable requests. In fact, they are standard for any financial institution using algorithmic trading. The AI code generation is just another algorithm.
Until then, the burden of proof is on the company. The crypto industry has a long history of over-promising and under-delivering. 'AI-first' is the newest iteration of that cycle. The Terra-Luna collapse, FTX fraud, and countless hacks were all preceded by confident statements about technology and controls. The audience cheered each time until the music stopped. Coinbase is not FTX. But the pattern of opacity is similar. The difference is the medium: code instead of balance sheets.
My takeaway is not a call to panic. It is a call to verify. If you are a Coinbase user, your funds are likely safe today. But the safety is contingent on human vigilance over machine outputs. That vigilance is expensive, and the incentive to lower its cost is high. In a bull market, the cost of vigilance is discounted. In a bear market, the cost of failure is magnified. Ledger balances do not lie; they only wait. And they wait for a clear signal that the code is trustworthy.
As of April 2025, that signal has not been sent. The 95% figure is a metric that demands a detailed breakdown. Until that breakdown is provided, the smart money remains cautious. Hype evaporates; receipts remain. The only receipt we have is the interview transcript. That is not enough.
Forward-looking thought: The next major crypto exchange to suffer a critical failure will likely trace it back to AI-generated code. The question is not if, but when. And when that happens, the regulatory pendulum will swing hard, forcing retroactive audits of every exchange's codebase. Coinbase's early adoption may become a liability if they cannot prove their human oversight is adequate. The rational response for investors is to demand transparency now. The rational response for users is to diversify custody. The rational response for regulators is to publish guidelines before the collapse, not after. But history suggests no one will act until the ledger proves them wrong.
Data does not forgive. And the data on 95% AI code is incomplete. As an investigator, that is the only conclusion I can draw: we need more data. Until then, treat the 95% claim as a hypothesis, not a fact. Trust is built on verification, not percentages.