The crypto industry faces a new challenge: artificial intelligence is dramatically accelerating the discovery of vulnerabilities in smart contracts, rendering one-time audits practically useless in a short time. This is not a hypothesis, but a confirmed trend that I track based on the latest data from leading analytical platforms.
Old contracts — new targets
Analysis of incidents in the first half of the year paints a worrying picture: losses in the Web3 sector amounted to approximately $1.32 billion as a result of 344 attacks. Net damage, accounting for frozen funds, is estimated at $1.2 billion. The key vector is code vulnerabilities: 204 cases totaling $151.6 million. Particularly notable is the growing share of attacks on contracts older than one year. This indicates a systematic return of attackers to old codebases, not just new projects.
A smart contract can remain active for years after its initial audit. During this time, bug-finding tools evolve, new exploitation techniques emerge, and old protocols often lose their support teams. The "window of maximum vulnerability" does not close after launch — re-auditing should become a regular operational requirement. Experts do not claim that the rise in attacks on old contracts is already proven to be caused by AI. However, such a pattern is likely supported by improvements in automated tools for finding hidden vulnerabilities in large volumes of code.
AI agents: from 2% to 55.88% in a year
The effectiveness of AI in this area is growing exponentially. On the SCONE-bench benchmark, where agents tested 405 real-world hacked contracts from 2020–2025, the result on a subset with vulnerabilities after the model's knowledge cutoff date rose from 2% to 55.88% in just one year. The total value of successfully simulated exploits increased from $5,000 to $4.6 million. Meanwhile, a full scan of a single contract costs an average of $1.22. As the price decreases and agent capabilities increase, the window between the appearance of defective code and its exploitation will shrink.
The Zcash case: even verified code can be dangerous
The Zcash example is a striking illustration. A security engineer discovered a critical vulnerability in the Orchard pool — one of the key components of private transactions. The bug existed from the activation of Orchard in May 2022 until an emergency fix in June 2026. It could have allowed the unnoticed creation of an unlimited number of fake ZEC within the pool. Due to the pool's private nature, the team could not cryptographically prove whether the vulnerability was exploited before the fix. This case shows: even code with a long history can contain defects that only become exploitable with new tools.
My expert opinion
The market is transitioning into an era where security is not a one-time event but a continuous process. AI tools lower the entry barrier for hackers, making even long-verified protocols vulnerable. Projects relying on old audits should reconsider their strategy: regular code scanning and anomaly monitoring are becoming not an option, but a necessity. Otherwise, losses — which have already reached $1.32 billion in half a year — will only grow.