The crypto industry is facing a new reality: old, long-proven smart contracts are no longer secure. Artificial intelligence is dramatically accelerating the discovery of vulnerabilities, making one-time audits conducted at a protocol's launch practically useless within just a few months. This is not a hypothesis, but an alarming trend confirmed by data from leading analytical firms.
According to my data, based on market analysis, in the first half of the year, losses in the Web3 sector from 344 incidents amounted to approximately $1.32 billion. Net damage, accounting for recoveries, is estimated at $1.2 billion. The key vector of attacks is code vulnerabilities: 204 cases totaling $151.6 million. Particularly noteworthy is the growing share of attacks on contracts older than one year. This indicates that attackers are systematically returning to old codebases, rather than just hunting for new projects.
Why old audits are losing their effectiveness
A smart contract can remain active for years. During this time, bug-finding tools change, new exploitation techniques emerge, and old protocols often lose their support teams and auditor attention. The "window of maximum vulnerability" does not close after launch — on the contrary, it widens. Projects with old infrastructure should consider re-auditing as a regular operational requirement. Although a direct link between AI and the rise in attacks on old contracts has not yet been proven, the pattern is clearly supported by improvements in automated tools for finding hidden defects in large code volumes.
Attack landscape: not just code, but also infrastructure
TRM Labs recorded 207 hacker attacks in the first half of the year — a record for their sample. Total damage amounted to $972 million, which is less than half the figure for the same period in 2025. This gap is explained by the structure of the attacks: most incidents (125 out of 207) involved smart contract exploits, but the main damage came from major infrastructure compromises — attacks on keys, signatures, and fund management systems. These accounted for only 15% of incidents but approximately 76% of stolen assets.
A separate factor is the activity of groups linked to North Korea. They stole approximately $643 million, or roughly two-thirds of all stolen funds. Almost all of this damage came from two April attacks: against Drift Protocol and KelpDAO.
The Zcash case: even proven code contains defects
A striking example is the Zcash incident. Security engineer Taylor Hornby discovered a critical vulnerability in the Orchard pool that had existed from May 2022 until an emergency fix in June 2026. The bug could have allowed the unnoticed creation of an unlimited number of fake ZEC. Due to the pool's private nature, the team could not cryptographically prove whether the vulnerability was exploited before the fix. Although Shielded Labs considers such a scenario unlikely, this case shows that even code with a multi-year history can contain fatal defects.
AI is changing the game
Anthropic published a study demonstrating the ability of AI agents to find and exploit vulnerabilities. On the SCONE-bench benchmark, agents tested 405 real-world hacked contracts from 2020–2025. Over the course of a year, the result increased from 2% to 55.88% on the subset of vulnerabilities after the model's knowledge cutoff date. The total value of successfully simulated exploits increased from $5,000 to $4.6 million. The average cost of a full scan of a single contract is just $1.22. As the price decreases and agent capabilities grow, the window between the appearance of defective code and its exploitation will shrink.
Attackers are already targeting protocols that have shut down or limited their operations. For instance, approximately $2.19 million was drained from Aztec Connect, a private transaction solution whose support was discontinued in 2023. Google Threat Intelligence Group recorded, for the first time, a hacker using a zero-day bug developed with the help of AI. Several new malware families are actively using large language models for attacks.
My expertise: The industry is on the verge of a fundamental shift. One-time audits are an anachronism. The future lies in continuous monitoring and automated re-testing. Projects that fail to adapt to the new reality, where AI works on both the defensive and offensive sides, risk becoming easy prey. Investors should demand from teams not just an "audit," but evidence of ongoing security updates.