The crypto industry is facing a new reality: one-time smart contract audits conducted at launch are rapidly losing relevance. Artificial intelligence is radically accelerating the discovery of vulnerabilities, turning old, "verified" contracts into attractive targets for attackers. This requires projects to fundamentally rethink their approach to security.
Analytics for the first half of 2025 paint a worrying picture. According to CertiK, losses in the Web3 sector amounted to approximately $1.32 billion across 344 incidents, with net damages after recoveries estimated at $1.2 billion. The key attack vector remains code vulnerabilities — 204 cases totaling $151.6 million. However, the most alarming signal is the systematic increase in attacks on contracts older than one year. Attackers are deliberately returning to old codebases, rather than solely hunting for fresh projects.
Why "one-time checks" no longer work
A smart contract can remain active for years. During this time, tools for finding bugs evolve, new exploitation techniques emerge, and support teams for old protocols often lose focus on security. Contrary to popular belief, the window of maximum vulnerability does not close after launch. Re-auditing should become not an exception, but a regular operational requirement. Moreover, as data shows, this trend is fueled precisely by the improvement of automated AI tools capable of finding hidden defects in vast amounts of code.
TRM Labs statistics deserve special attention: a record number of attacks — 207 — were recorded in half a year. Although the total damage of $972 million is lower than the previous year's figures, the structure of these attacks is telling. The majority of incidents (125 out of 207) involve smart contract exploits, but the main financial losses (about 76% of stolen assets) are caused by infrastructure compromises — attacks on keys, signatures, and management systems. This underscores that security is not limited solely to contract code.
The activity of hacker groups linked to the DPRK remains a critical factor. According to estimates, they stole approximately $643 million, or two-thirds of all stolen funds, with nearly all of this damage stemming from two April attacks against Drift Protocol and KelpDAO.
AI as a hacker's tool: from theory to practice
Anthropic's research on the SCONE-bench benchmark demonstrates alarming dynamics. AI agents auditing real-world exploited contracts improved their performance in finding vulnerabilities from 2% to 55.88% over the course of a year. The value of successfully simulated exploits rose from $5,000 to $4.6 million. Meanwhile, the average cost of a full scan of a single contract is just $1.22. As this price decreases and agent capabilities grow, the time gap between the appearance of defective code and its exploitation will relentlessly shrink.
The case of Zcash is also telling, where a critical vulnerability in the Orchard pool existed from 2022 until an emergency fix in 2026. This is clear proof: even code with a multi-year history can contain fatal defects. And the attack on the long-defunct Aztec Connect protocol, from which $2.19 million was drained, confirms that attackers do not shy away from "dead" projects either.
Expert opinion: The industry must recognize: security is not a development stage, but a continuous process. Projects, especially those with outdated infrastructure, need to implement systems for constant monitoring and automated auditing. Ignoring this trend is tantamount to inviting AI-armed hackers to your code.