AI Is Industrializing Crypto Hacks, but the ‘Hackpocalypse’ May Still Be Coming

Fears of an artificial intelligence-driven hacking epidemic in decentralized finance have been exaggerated—at least for now. But that may simply be the lull before a more serious storm arrives.

High-profile crypto hacks in April 2026, suspected by many to involve sophisticated AI tools, sparked widespread alarm about DeFi’s vulnerability. The string of exploits prompted Manuel Aráoz, founder of security platform OpenZeppelin, to declare the entire DeFi sector “unsafe” after $630 million in losses that month alone. Industry observers braced for a cascade of protocol failures.

Instead, the predicted deluge never materialized. Haseeb Qureshi, managing partner at venture firm Dragonfly, recently argued that fears of a DeFi “hackpocalypse” were overblown, noting that year-to-date figures showed a lower rate of losses per month and a declining median hack size, even accounting for April’s damage.

But this apparent reprieve shouldn’t breed complacency, according to Stephen Ajayi, leading offensive security engineer at Hacken. “The ‘hackpocalypse’ narrative is overstated if it suggests AI has replaced compromised keys, weak infrastructure and human error as the main causes of Web3 losses,” he explained. However, he emphasized that dismissing the threat as non-existent misses the point: “I would not confuse ‘not dominant yet’ with ‘not coming.'”

The Real Driver: Scale, Not Innovation

AI’s true impact on crypto crime appears less about inventing new attack methods and more about amplifying existing ones. According to CertiK’s H1 2026 report, Web3 protocols suffered over $1.3 billion in losses across 344 security incidents during the first half of the year—but proving which involved AI-assisted exploits remains difficult.

Natalie Newson, senior blockchain investigator at CertiK, highlighted circumstantial evidence of AI’s growing role: a significant increase in attacks targeting older smart contracts and unverified code. The report found 73 code vulnerability incidents deployed for over a year before exploitation in H1 2026, compared to 45 for all of 2025. This pattern suggests AI is helping attackers analyze vastly larger volumes of code than previously feasible.

“AI systems can help analyze codebases, identify patterns associated with known vulnerabilities, flag suspicious logic, summarize complex code, and prioritize areas for deeper review,” Newson explained. Rather than replacing traditional attack vectors, AI is industrializing them.

Data from Hacken’s Q2 2026 security report underscores this point: approximately 88% of stolen value—$763.9 million out of $763.97 million total—resulted from compromised keys, signers, and infrastructure rather than smart contract exploits. Wallet compromise accounted for the largest losses in CertiK’s H1 analysis, with $444 million stolen across just 33 incidents.

Beyond Code: AI Supercharges Fraud

The threat extends beyond smart contract vulnerabilities. According to Chainalysis, AI-enabled scams generate 4.5 times more profit than traditional schemes, extracting $3.2 million per operation versus $719,000 for non-AI variants. Impersonation scams surged over 1,400% year-over-year in 2025, with criminals deploying AI-generated deepfakes and face-swapping tools readily available on Telegram marketplaces.

Attackers are increasingly using large language models to reverse-engineer bytecode from unverified contracts at scale. Chainalysis identified $36.7 million stolen from protocols whose source code was never publicly verified—a vulnerability attackers can now exploit more systematically with AI assistance.

The convergence of these trends suggests AI’s greatest impact will come where human effort has traditionally been the bottleneck. As Newson noted, “The biggest risk is that attackers no longer need technical expertise or strong language skills.”

As AI continues to industrialize crypto attacks and lower barriers to entry for criminals, robust security audits and continuous monitoring become critical safeguards across all blockchain protocols and digital asset platforms.

Source: CertiK, via Cointelegraph. Not financial advice.