Crypto Security Faces Its Biggest AI Test

Artificial intelligence is reshaping crypto security on both sides of the fence. Attackers are using it to find vulnerabilities faster. Defenders are scrambling to keep up. And the traditional one-time smart contract audit, long a cornerstone of protocol security, is starting to look dangerously inadequate.

One-Time Audits Are No Longer Enough

TRM Labs head of policy Ari Redbord put it plainly: "Our data argues for continuous review rather than a one-time audit," adding that "attack techniques are moving faster than a single audit from launch day can account for." The warning follows a period of sustained losses across the industry. According to CertiK's Hack3d: H1 2026 Report, crypto projects lost about $1.32 billion across 344 incidents in the first half of 2026. The headline figure looks better than it is. The total is lower than the $2.47 billion stolen in the same period last year, but that comparison is skewed by a single $1.45 billion Bybit hack that dominated 2025 figures. Excluding that incident, losses in 2026 were significantly higher than in the comparable period, suggesting the overall security environment has not improved.

TRM's own analysis found that the number of incidents more than doubled from 83 to 207 in H1, the highest number TRM has recorded across a six-month period, with smart contract exploits accounting for 125, or 60%, of those incidents. One of the strategies attackers have adopted is to revisit old codebases, with CertiK noting their efforts have likely been "aided by improved automated tooling for identifying latent vulnerabilities at scale."

A Four-Year Zcash Bug Signals the Stakes

The risks embedded in legacy code were thrown into sharp relief by a recent discovery at @zcash. A Shielded Labs security engineer found a major vulnerability using a custom auditing agent powered by Anthropic's Claude Opus 4.8. The bug has since been patched. The security vulnerability, which had existed for four years, could have enabled undetectable counterfeiting inside the Orchard shielded pool, one of the network's key privacy features. The issue was identified using a custom auditing agent built on Anthropic's Claude Opus 4.8.

CertiK warned that "the window of maximum vulnerability does not close after launch," urging projects operating legacy infrastructure to "treat reauditing as a recurring operational requirement rather than a one-time exercise conducted at deployment." There is more than $72.3 billion worth of crypto locked across hundreds of DeFi protocols, giving hackers ample incentive to pursue older, under-scrutinised code.

The picture that emerges is one where AI is compressing the timeline between a vulnerability being introduced and it being found, by whoever gets there first. For protocols still relying on a single pre-launch audit, the exposure is growing by the day.

Sources:
CoinTelegraph: AI is shortening the shelf life of crypto security audits, researchers warn
CoinTelegraph: Crypto Exploits Drop 47% in H1 But Danger Persists, CertiK
DailyCoin: Crypto Hackers Stole $1.3B in H1 2026