A wave of high-profile cryptocurrency hacks in April led many to suspect that they were orchestrated using advanced AI tools to identify smart contract exploits, raising concerns that all DeFi protocols could suddenly be at risk.
Manuel Araoz, founder of blockchain security platform OpenZeppelin, declared in May that “all DeFi is insecure” after an exploit cost him $630 million in cryptocurrencies in April.
But even as the industry prepares for a scenario in which DeFi protocols fall like dominoes into agent AI, the flow of attacks appeared to be slowing down.
For this reason, Dragonfly Managing Partner Haseeb Qureshi recently declared that concerns about DeFi’s “hackpocalypse” were “misinformation.” He pointed out that even including the large-scale hack in April, “the amount of hacks per month has decreased” since the beginning of this year, and that “the median size of hacks per year has also decreased.”
So who is right? Are concerns about widespread AI hacking completely overblown, or is this just the lull before the storm?
“I think the ‘hack apocalypse’ narrative is overstated if it suggests that AI has already replaced compromised keys, weak infrastructure, and human error as the main causes of Web3 losses,” Stephen Ajayi, principal offensive security engineer at Hacken, tells Magazine.
But that doesn’t mean the concerns are completely unfounded, he added.
“I don’t want to confuse ‘not yet dominant’ with ‘not going to be dominant’. My view is that we are still in the early stages. The hype is ahead of the incident data, but the capability curve is quickly catching up,” Ajayi clarifies.
AI is changing attacks, even if it’s not the cause
According to CertiK’s first half report, the Web3 protocol suffered losses of over $1.3 billion in 344 security incidents in the first half of 2026.
It is impossible to say how many of these incidents involve exploits identified or facilitated by AI. “Proving whether AI was used to find an exploit can be difficult,” explains Natalie Newson, senior blockchain researcher at CertiK.
Related: AI-driven hacking could devastate DeFi – unless projects act now
Rather than looking for direct attribution, Newson said they are looking for circumstantial evidence, such as changes in the attacker’s behavior. She points out that there has been a significant increase in the misuse of old and unverified smart contracts.
A CertiK report found that 73 code vulnerability incidents in the first half of 2026 had been deployed for at least a year before being exploited. “For all of 2025, the number was 45,” Newson said. This suggests that AI is helping attackers analyze much larger amounts of code than was previously practical.
Rather than inventing completely new attack classes, AI seems to be making existing attack classes cheaper, faster, and easier to extend.
Monthly change in cryptocurrency exploitation volume and number of incidents in the first half of the year. Source: CertiK
“AI systems can help analyze codebases, identify patterns related to known vulnerabilities, flag questionable logic, summarize complex code, and prioritize areas for more detailed review,” says Newson.
“Both attackers and defenders can inspect far more contracts in a given amount of time,” he said, noting that this means older codebases may now be at risk.
The real danger is scale.
Blockchain data platform Chainalysis also sees AI’s biggest impact as amplifying activity, thereby industrializing familiar forms of cryptocrime.
“The 2026 Crypto Crime Report found that AI-powered crypto scams are 4.5 times more profitable than traditional scams, extorting $3.2 million compared to $719,000 in a single operation,” Sally Hanif, head of UK public sector at Chainalysis, told the magazine.
“AI allows fraudsters to reach and manipulate far more victims simultaneously.”
The dangers do not only come from the misuse of smart contracts. According to research by Chainalies, identity fraud increased by more than 1,400% in 2025 compared to the previous year, with criminals using AI-generated deepfakes and face-swapping software readily available on the Telegram marketplace.
“We have seen AI significantly enhance existing playbooks,” he says. “The fraud-as-a-service ecosystem now offers modular turnkey services, with AI increasing the efficiency of each module.”
Related: AI models sparked a “vulnerability apocalypse” in cryptocurrency security: Immunefi CEO
Chainalysis recently identified $36.7 million stolen from protocols whose smart contract source code has not been publicly verified. Hanif warns that attackers are using large-scale language models to reverse engineer raw bytecode and identify large-scale vulnerabilities.
Data: $36.7 million from unconfirmed contracts. Source: Chainalysis
“AI has the potential to have the greatest impact where human efforts have traditionally been a bottleneck,” Newson said. “We’re seeing AI being used to impersonate support staff, video calls, and influencers (…) The biggest risk is that attackers don’t need technical expertise or advanced language skills.”
So where did the multi-billion dollar hack come from?
Looking at the data, the biggest crypto losses in 2026 could have been carried out without the use of AI.
A CertiK report found that wallet breaches remained the most damaging attack vector in the first half of this year, with just 33 incidents resulting in more than $444 million in losses.
According to Hacken’s Web3 Security Report for Q2 2026, approximately 88% of the value stolen in Q2 was due to compromises of keys, signers, and operational infrastructure rather than smart contract bugs, and was primarily due to two North Korea-related attacks against Drift Protocol and Kelpdao.
Of the $763,971,791 stolen, 88.3% was traced back to compromised keys, signers, and infrastructure. Source: Hakken
Ajay said that rather than replacing traditional attack techniques, AI is amplifying them by identifying vulnerable employees, generating convincing phishing campaigns, analyzing public code, and accelerating exploit development. However, weak governance, poor operational security, and weak infrastructure still determine whether attacks are successful.
“AI is the new amplifier, but old security flaws are still determining the scale of the explosion,” he says.
AI changes the battlefield, but not the fundamentals
Of course, AI can also be used as a force for good, and the security industry is also deploying AI on the defensive side. Hanif said law enforcement is moving from being reactive to being proactive, and that “tools now exist to stop fraud before victims lose money.”
“Ultimately, AI is likely to enhance the capabilities of both attackers and defenders, and the balance of advantage will depend on who can most effectively integrate and operate the technology,” Newson said.
Magazine: Strategy became a symbol of the dot-com crash: Will history repeat itself?
Cointelegraph publishes long-form journalism, analysis, and narrative reports produced by Cointelegraph’s in-house editorial team with subject matter expertise. All articles are edited and reviewed by Cointelegraph editors according to our editorial standards. The content published here does not constitute financial, legal or investment advice. Readers should conduct their own research and, if appropriate, consult a qualified professional. Cointelegraph maintains complete editorial independence.
