AI Shortens the Shelf Life of Crypto Security Audits

The shelf life of crypto security audits is being shortened by AI technology. Blockchain security experts are urging crypto protocols to reaudit their smart contracts as AI tooling makes it easier for hackers to identify vulnerabilities more quickly than ever before. TRM Labs head of policy Ari Redbord said, "Our data argues for continuous review rather than a one-time audit," adding that "attack techniques are moving faster than a single audit from launch day can account for." CertiK reported that hackers stole another $1.32 billion in the first half of 2026 and have adopted increasingly sophisticated strategies in response to strengthened security measures across the industry. One of those strategies has been to revisit old codebases, CertiK said, adding that the attackers' efforts have likely been "aided by improved automated tooling for identifying latent vulnerabilities at scale." One of the most recent incidents involved privacy-focused blockchain Zcash, where Shielded Labs security engineer Taylor Hornby found a major security vulnerability using a custom auditing agent powered by Anthropic’s Claude Opus 4.8. The bug has since been patched. The security vulnerability, which existed for four years, could have enabled undetectable counterfeiting inside the Orchard shielded pool, one of the network’s key privacy features. CertiK warned, "The window of maximum vulnerability does not close after launch." "Projects operating legacy infrastructure should treat reauditing as a recurring operational requirement rather than a one-time exercise conducted at deployment," the company added. In December, Anthropic conducted a study finding that AI agents found $4.6 million worth of exploitable vulnerabilities in smart contracts. Meanwhile, there is more than $72.3 billion worth of crypto locked across hundreds of DeFi protocols, giving hackers plenty of incentive to exploit vulnerable smart contracts. SlowMist's estimate of total crypto losses from blockchain hacks. On June 14, hackers exploited a smart contract vulnerability to steal $2.1 million from the Aztec Connect, which had been shut down since March 2023. Five days later, a smart contract on the decentralized exchange mySwap was exploited for $300,000, even after the mySwap user interface had been closed to new liquidity deposits for more than six months. A more fortunate event took place in May, when a white hat, known as "0xflorent," helped recover 1,003 Ether (ETH) worth over $1.72 million from 48 investors involved in the Hong Coin (HONG) initial coin offering in 2016. The ICO failed to launch after missing its funding target, and the funds remained locked in the smart contract due to a bug in the auto-refund function. Redbord said, "The work doesn’t stop with hardening the codebase and infrastructure," explaining that the broader industry and regulators need to continue finding ways to mitigate malicious cyberactivity from North Korea and disrupt Chinese money laundering networks: "DeFi Hacks Shake Institutional Confidence as Risks Outpace Yields". As the crypto security landscape continues to evolve, it's clear that the role of AI in identifying vulnerabilities will only continue to grow. In the end, it's up to the industry to ensure that security measures keep pace with the rapid advancement of AI technology.