The practice of one-time smart contract audits is rapidly becoming obsolete. Modern AI tools can find vulnerabilities in code with such speed and precision that the "security window" between a protocol's launch and its hack is shrinking to a minimum. Projects relying on audits from a year ago should reconsider their strategy: old contracts are becoming easy prey for automated attacks.
My data confirms: exploitation methods change faster than classic audits can account for them. In the first half of the year, Web3 sector losses amounted to approximately $1.32 billion across 344 incidents. Net damage, accounting for recoveries, is roughly $1.2 billion. The main attack vector is code vulnerabilities: 204 cases totaling $151.6 million. At the same time, the share of hacks targeting contracts older than one year has noticeably increased. Attackers are systematically returning to old codebases, not just hunting for new projects.
Why Old Contracts Are the New Target
A smart contract can remain active for years. During this time, bug-finding tools evolve, new exploitation techniques emerge, and support teams move on. The "maximum vulnerability window" does not close after launch. Projects with legacy infrastructure should consider re-auditing a regular operational requirement. And while there is no 100% proof that the rise in attacks on old contracts is specifically due to AI, the pattern is clearly supported by improvements in automated tools for finding hidden defects in large code volumes.
TRM Labs recorded a record 207 hacker attacks over six months. Total damage was $972 million. Most incidents (125 out of 207) involved smart contract exploits. However, the main damage came not from these, but from major infrastructure compromises—attacks on keys, signatures, and fund management systems. These accounted for about 15% of incidents but roughly 76% of stolen assets. Notably, North Korean groups were active, stealing approximately $643 million—nearly two-thirds of all funds.
The Zcash Case: A Multi-Year Error in the Private Pool
A telling example is the vulnerability in the Orchard pool of the Zcash network. A critical error existed from its activation in May 2022 until an emergency fix in June 2026. It could have allowed the unnoticed creation of an unlimited number of fake ZEC. Due to the pool's private nature, the team could not cryptographically prove whether the vulnerability was exploited. Although the scenario is considered unlikely, it is a clear example: even verified code with a multi-year history can contain hidden defects.
How AI Is Changing the Game
The effectiveness of AI in finding vulnerabilities is growing exponentially. On the SCONE-bench benchmark, agents tested 405 real-world hacked contracts. The result improved from 2% to 55.88% in one year. The total value of successfully simulated exploits increased from $5,000 to $4.6 million. The average cost of a full scan of one contract is just $1.22. As the price drops and agent capabilities grow, the window between the appearance of defective code and its exploitation will shrink.
Attackers are already targeting protocols that have ceased support. For example, about $2.19 million was withdrawn from Aztec Connect, a private transaction solution shut down in 2023. Google recorded the first instance of a hacker using a zero-day error developed with AI. And this is just the beginning.
My opinion: The industry is transitioning to a new reality where a one-time audit is not protection, but merely a starting point. Projects that fail to implement continuous monitoring and regular security updates risk ending up on the victim list. Old contracts are a ticking time bomb, and AI has become the detonator.