TLDR
- Ethereum co-founder Vitalik Buterin warns that blockchain security protecting on-chain assets does not extend to off-chain activities managed by validators
- Even if 51% of validators collude or experience software bugs, they cannot steal funds stored on the blockchain due to cryptographic protections
- Off-chain tasks like oracle data feeds, bridges, and governance decisions rely on validator honesty rather than algorithmic verification
- Polygon CTO Mudit Gupta noted that while validators cannot alter Ethereum’s state, they can still exploit users through MEV or censorship
- Buterin confirmed that platforms like EigenLayer address these vulnerabilities through slashing mechanisms using their own tokens
Ethereum co-founder Vitalik Buterin issued a warning on October 26 about the limits of blockchain security. He explained that while on-chain assets remain protected even during a 51% attack, this protection disappears when users trust validators with off-chain tasks.
Ethereum co-founder Vitalik Buterin warns that blockchain security stops where trust in external validators begins. Even a 51% attack can’t validate bad blocks, but relying on bridges or oracles introduces trust and risk. How much control should validators have?
— Pup Mentor (@pupmentor) October 26, 2025
Buterin posted on social media that blockchain protocols prevent even a majority of validators from stealing user funds. Every node in the network independently verifies transactions and blocks. This means colluding validators cannot forge transactions or create invalid blocks.
The system works through strict validation rules that check transaction signatures and prevent double-spending. No single party can override these safeguards. Even if a majority of validators work together, they cannot bypass the protocol’s fundamental protections.
Ethereum co-founder Vitalik Buterin warned that a blockchain’s core security property is that even a 51% attack cannot make an invalid block valid, meaning colluding validators can’t steal users’ assets. However, he noted this protection doesn’t extend off-chain—if 51% of…
— Wu Blockchain (@WuBlockchain) October 26, 2025
However, Buterin stressed that this security boundary has clear limits. When validators handle activities outside the blockchain’s direct control, the cryptographic guarantees no longer apply. These off-chain tasks include oracle data feeds, bridge operations, and governance decisions.
Off-chain activities depend on validator honesty rather than algorithmic enforcement. A colluding majority could provide false data or manipulated outcomes. The blockchain cannot verify or dispute decisions made beyond its consensus layer.
Users affected by off-chain collusion have no automatic recovery mechanism. Traditional blockchain verification requires computers to perform 100 times as much work as the original calculation. But when funds move off-chain through custodial wallets or centralized exchanges, users surrender these built-in protections.
Validator Control and System Vulnerabilities
Polygon Chief Technology Officer Mudit Gupta supported Buterin’s warning. He explained that while validators cannot alter Ethereum’s state directly, they can still exploit users. This includes extracting value through MEV or enforcing censorship on transactions.
Seun Lanlege, co-founder of Polkadot’s Hyperbridge, offered a different view. He argued that validator influence extends deeper than MEV or censorship. A malicious majority could manipulate block propagation or isolate nodes through eclipse attacks.
Robert Sasu, a core developer at MultiversX, urged teams to minimize off-chain dependencies. He stated that teams should move everything on-chain directly in a decentralized Layer 1. Any reliance on centralized systems like bridges or oracles invites manipulation.
When asked about restaking protocols like EigenLayer, Buterin confirmed these platforms address vulnerabilities through slashing mechanisms. EigenLayer uses its own token to penalize validators who act dishonestly. This economic penalty system provides some protection but cannot match the cryptographic guarantees that secure on-chain transactions.
Privacy Development and Security Balance
Buterin’s security reminder comes as Ethereum pursues privacy improvements. Earlier in October, he detailed GKR, a cryptographic technique that verifies calculations 10 times faster than traditional methods. This technology enables zero-knowledge proofs that can prove calculations are correct without revealing underlying data.
The Ethereum Foundation launched a 47-member Privacy Cluster in September. The group aims to make network privacy default rather than optional. Current blockchain transparency exposes too much financial information, which limits mainstream adoption.
Industry expert Petro Golovko compared current blockchain transparency to the pre-encryption internet era. He argued that systems exposing salaries and account balances remain unusable for regular people and impossible for institutions. The initiative aims to enable private transactions and selective identity disclosure while maintaining verification mechanisms.
Cryptographic techniques like GKR allow verification of transaction validity without exposing transaction details. This preserves the blockchain’s core security property where invalid blocks remain rejected even under majority attacks. At the same time, it shields sensitive financial data from public view.
