How AI can help and undermine the security of cryptocurrencies

Earlier this month, attackers stole $6 million from the DeFi protocol Summer.fi, and an AI system caught him red-handed. Security company Blockaid's detection system flagged the exploit while funds were still being transferred, helping the agreement suspend its vaults and contain losses.

This successful interception is just one piece of a larger story: AI has become both cryptocurrency's latest security guard and its latest thief. Just a few weeks ago, this was fully demonstrated.

On May 29, independent security researcher Taylor Hornby aligned Anthropic's Claude Opus 4.8 with Zcash's code base. In less than a day, he discovered a flaw in the Orchard shield pool that human expert reviewers had failed to detect in the past four years.

Zcash (ZEC) founder Zooko Wilcox made it clear in his disclosure: "Taylor wrote a complete exploit program with the help of Opus 4.8, and when he tested it in a local regression testing environment, the program generated infinite and undetectable counterfeit ZECs."

Zcash plunged 60% due to AI audits

Zcash engineers urgently pushed a soft fork within a few days and activated the NU6.2 hard fork on June 3. Subsequently, a public disclosure was made on June 4 that the ZEC price fell from approximately US$630 to an intraday low of approximately US$250, a drop of approximately 60%, and the amount cleared within 24 hours exceeded US$116 million. As of now, there is no evidence that any assets have been stolen or any forged ZECs have been minted.

A well-intentioned researcher used a commercial AI model to crack down on the price of a major token even more than most actual exploits.

In other words, the same model that saved Zcash could have destroyed it. The results depend on who conducted the audit first.

AI can provide cheaper audits at API costs

Human-led smart contract audits will cost from US$5000 for simple tokens to US$250,000 or more for complex agreements in 2026, and will take weeks. The same guide states that the cost of pure AI scanning is as low as $0.02 per line of code. Coinbase has developed Frosty, an internal AI audit tool that the exchange says outperforms other tested tools in vulnerability detection.

Hornby's discovery of Zcash required only a researcher, a custom framework, and a model. It is unclear how much tokens he spent to reveal the attack vector.

Vitalik Buterin, co-founder of Ethereum (ETH), believes that the ultimate situation will be in favor of defenders, through AI-assisted formal verification, which uses mathematical proof from machine inspections to show that the code is working as expected. "Many people claim that with AI-assisted vulnerability discovery, security code (and thus nothing that needs to be trusted) will become impossible. I am more optimistic. AI-assisted formal verification is one of the main reasons." He wrote in May.

AI may lead to more attacks and cost less

Security firm SlowMist statistics that there were 182 cryptocurrency attacks in the first half of 2026, a year-on-year increase of 50%, although total losses dropped from $2.37 billion to $956 million. Its researchers found that the attackers "extensively used AI tools such as ChatGPT and Cursor during the attack to assist in code generation, write communication content, and optimize social engineering speech."

As AI lowers the entry threshold for crimes, more people are able to commit crimes. AI agents themselves have also become targets. In May, an attacker embedded Morse code instructions in a message sent to the Grok chatbot, which forwarded the transfer instruction, which was parsed and executed by the transaction agent BankelBot, transferring $175,000 in real chain assets.

CertiK CEO Ronghui Gu called this an "asymmetric security war." A profit-driven attacker can focus huge computing power on a single target, while a defender protecting that target needs to divert attention to hundreds of customers.

Anthropic's Mythos large language model complicates the situation

Anthropic's restricted Mythos model demonstrates the sharpness of the double-edged sword of AI security. The company said the Mythos-like model is capable of discovering and exploiting software vulnerabilities and independently running some autonomous network operations, so it only grants access to vetted defenders.

Through the Project Glasswing project (backed by up to $100 million in usage credits), Anthropic reported that defenders, including Microsoft, Google, JPMorgan Chase and Cisco, had discovered more than 10,000 high-or critical vulnerabilities as of the end of May. Fortunately, Zcash received defender treatment. After Orchard's fix, Wilcox announced that a Mythos audit of the agreement "did not reveal any more serious vulnerabilities."

Unfortunately, a clean audit can only last until more powerful models emerge. SingularityNET CEO Ben Goertzel expects a repeat of the Zcash model, warning that similar flaws have not yet been discovered in other cryptocurrencies and traditional banking software and will surface "in the next few weeks to months."

Yan Pritzker, chief technology officer of Swan Bitcoin, provided a useful judgment on where the danger lies, pointing out that AI will not change Bitcoin's encryption algorithm or the consensus rules implemented by its node network. Exchanges, custodians and users are arguably the more vulnerable targets, and AI-scale phishing attacks can target humans and centralized software around the chain.

What AI means to your portfolio

Bug disclosures can now drive price movements within hours, and ZEC holders have experienced a 60% pullback in the face of unexploited vulnerabilities. If you own small-cap tokens, the risks of vulnerability disclosure and complete collapse are worth considering in conjunction with the risks of Rug Pull and decoupling.

Think of "AI auditing" as a starting point rather than a security certificate. When Coinbase tested ChatGPT on 20 token contracts in early experiments, the model mistakenly rated five high-risk assets as low risk, failing to meet the standards of Coinbase's asset review process. AI trading agents should also be regarded as hot wallets because they are essentially-just add an extra layer of risk. They are software that holds your private key and acts on instructions (sometimes from the open Internet).

The Zcash incident showed that AI discovered vulnerabilities before criminals did, while SlowMist's data showed criminals were adopting the same tool on a large scale. Both trends are likely to accelerate here. Sooner or later, the gap between the agreement to run cutting-edge model audits and the agreement to skip audits will show up in price.