AI is shortening the shelf life of crypto security audits, researchers warn

Blockchain security experts are urging crypto protocols to reaudit their smart contracts as AI tooling is making it easier for hackers to identify vulnerabilities more quickly than ever before.

“Our data argues for continuous review rather than a one-time audit,” TRM Labs head of policy Ari Redbord told Cointelegraph, adding that “attack techniques are moving faster than a single audit from launch day can account for.”

“An audit built for last year’s attack patterns leaves a protocol exposed to this year’s as bad actors are changing up.”

CertiK reported Monday that hackers stole another $1.32 billion in the first half of 2026 and have adopted increasingly sophisticated strategies in response to strengthened security measures across the industry.

One of those strategies has been to revisit old codebases, CertiK said, adding that the attacker’s efforts have likely been “aided by improved automated tooling for identifying latent vulnerabilities at scale.”

One of the most recent incidents involved privacy-focused blockchain Zcash, where Shielded Labs security engineer Taylor Hornby found a major security vulnerability using a custom auditing agent powered by Anthropic’s Claude Opus 4.8. The bug has since been patched.

The security vulnerability, which existed for four years, could have enabled undetectable counterfeiting inside the Orchard shielded pool, one of the network’s key privacy features.

“The window of maximum vulnerability does not close after launch,” CertiK warned. “Projects operating legacy infrastructure should treat reauditing as a recurring operational requirement rather than a one-time exercise conducted at deployment.”

In December, Anthropic conducted a study finding that AI agents found $4.6 million worth of exploitable vulnerabilities in smart contracts. Meanwhile, there is more than $72.3 billion worth of crypto locked across hundreds of DeFi protocols, giving hackers plenty of incentive to exploit vulnerable smart contracts.

SlowMist’s estimate of total crypto losses from blockchain hacks. Source: SlowMist

Defunct crypto protocols targeted

On June 14, hackers exploited a smart contract vulnerability to steal $2.1 million from the Aztec Connect, which had been shut down since March 2023.

Five days later, a smart contract on the decentralized exchange mySwap was exploited for $300,000, even after the mySwap user interface had been closed to new liquidity deposits for more than six months.

A more fortunate event took place in May, when a white hat, known as “0xflorent,” helped recover 1,003 Ether (ETH) worth over $1.72 million from 48 investors involved in the Hong Coin (HONG) initial coin offering in 2016.

Related: ‘All DeFi unsafe’ claim sparks AI security debate after April hack surge

The ICO failed to launch after missing its funding target, and the funds remained locked in the smart contract due to a bug in the auto-refund function.

Reaudits only part of the equation, TRM says

The work doesn’t stop with hardening the codebase and infrastructure, Redbord said, explaining that the broader industry and regulators need to continue finding ways to mitigate malicious cyberactivity from North Korea and disrupt Chinese money laundering networks:

“Protocols can lock their doors, but someone still has to go after the actor breaking in.”

Features: DeFi hacks shake institutional confidence as risks outpace yields