Current concerns about the proliferation of AI-driven DeFi attacks are exaggerated, but will not las

A series of high-profile cryptocurrency hacking attacks in April, which many suspected were carefully planned using sophisticated AI tools to identify smart contract vulnerabilities, raised concerns that every DeFi protocol was suddenly at risk.

In May, Manuel Aráoz, founder of blockchain security platform OpenZeppelin, declared that "all DeFi is insecure" after a vulnerability attack caused US$630 million in cryptocurrency losses in April.

But even as the industry prepares for a scenario where the DeFi protocol is compromised like a domino by AI agents, the wave of attacks seems to have subsided.

This prompted Dragonfly managing partner Haseeb Qureshi to recently declare that concerns about DeFi's "hacking doomsday" were a "false alarm." He pointed out that even taking into account major hacking attacks in April,"the monthly rate of hacked amounts has dropped" so far this year and "the median annual hacking scale has also declined."

So who is right? Are concerns about the AI-driven hacking epidemic completely exaggerated, or is this just the tranquility before the storm?

"I think the term 'the end of hackers' is exaggerated if it suggests that AI has replaced key leaks, weak infrastructure and human error as the main causes of Web3 damage," Stephen Ajayi, Hacken's chief attack security engineer, told this newspaper.

But he added that doesn't mean the concerns are completely unfounded. "I wouldn't confuse 'not yet dominant' with 'not coming.'" My view is that we are still in the early stages: hype precedes event data, but the ability curve is catching up quickly,"Ajayi clarified.

AI is changing the way it attacks, even if it does not directly cause attacks

According to CertiK's H1 report, the Web3 protocol lost more than $1.3 billion in 344 security incidents in the first half of 2026.

It is impossible to determine how many of these incidents involved AI-identified or assisted exploits. Natalie Newson, senior blockchain investigator at CertiK, explained,"Proving whether AI is being used to discover vulnerabilities can be difficult."

Related: AI-driven hacking could destroy DeFi-unless the project acts immediately

Newson said she does not look for direct attribution, but focuses on circumstantial evidence, such as changes in attacker behavior. She pointed out that the use of older smart contracts and unverified contracts has increased significantly.

CertiK's report found that 73 code vulnerability incidents in the first half of 2026 had been deployed for at least a year before they were exploited. "For the full year of 2025, the number will be 45," Newson said. This suggests that AI is helping attackers analyze larger amounts of code than has ever been practical.

AI does not seem to be inventing a completely new class of attacks, but rather making existing attacks cheaper, faster, and easier to scale.

Monthly changes in the amount of cryptocurrency exploits and the number of incidents during H1. Source: CertiK

"An attacker or defender can check more contracts in a given time," she said, meaning older codebases could now be at risk.

The real danger lies in scale.

Blockchain data platform Chainalysis also believes that AI's greatest impact is as a multiplier of activity, industrializing familiar forms of cryptocurrency crime.

Sully Hanif, UK public sector head at Chainalysis, told this newspaper,"Our 2026 cryptocurrency crime report found that AI-assisted cryptocurrency scams were 4.5 times more profitable than traditional scams, with an average profit of $3.2 million per operation, compared with $719,000 for traditional scams."

"AI enables fraudsters to reach and manipulate more victims at the same time."

The danger comes not just from smart contract vulnerabilities. Chainalysis found that impersonation fraud increased by more than 1400% year-on-year in 2025, with criminals using AI-generated deep counterfeiting and facial exchange software that is easily available on the Telegram market.

"We are seeing AI accelerating existing attack patterns," he said. "The fraud-as-a-service ecosystem now provides modular, turnkey services, and AI makes each module more effective."

Related: AI model leads to 'vulnerability doomsday' in cryptocurrency security: Immunefi CEO

Chainalysis recently discovered that $36.7 million was stolen from a smart contract whose source code was never publicly verified. Hanif warned that attackers are using large language models to reverse engineer raw bytecode and identify vulnerabilities on a large scale.

Data: US$36.7 million from unverified contracts. Source: Chainalysis

"AI may have the greatest impact in its traditional human bottleneck areas," Newson said. "We have observed that AI is used to impersonate support personnel, video calls, influencers... the biggest risk is that attackers no longer need technical expertise or strong language skills."

So where did the billion-dollar hacking come from?

Judging from the data, the largest cryptocurrency loss in 2026 may have occurred without the use of AI.

CertiK's report found that wallet leaks remained the most damaging attack vector in the first half of the year, causing more than $444 million in losses in 33 incidents alone.

Hacken's 2026 Q2 Web3 Security Report found that approximately 88% of the total value stolen in the second quarter was due to key, signer and operating infrastructure leaks, rather than smart contract vulnerabilities, mainly due to two North Korea-related attacks, targeting Drift Protocol and KelpDAO.

Of the $763,971,791 stolen, 88.3% was traced to key, signer and infrastructure leaks. Source: Hacken

Ajayi said AI does not replace traditional attack methods, but amplifies these methods by identifying vulnerable employees, generating convincing phishing activities, analyzing public code, and accelerating exploit development. However, governance loopholes, poor operational security and weak infrastructure still determine whether an attack is successful.

"AI is a new amplifier, but old safety failures still determine the scale of the explosion," he said.

AI has changed the battlefield, but not the fundamentals

Of course, AI can also be used for just causes, and the security industry is deploying it defensively. Hanif said investigators are moving from passive to proactive, and "there are now tools to stop scams before victims lose money."

"Ultimately, AI may enhance the capabilities of both attackers and defenders," Newson said."The balance of advantage depends on which party can integrate and use the technology most effectively."