The crypto industry is facing a new reality: a one-time smart contract audit no longer guarantees security. The development of artificial intelligence is radically accelerating the search for vulnerabilities, shortening the "shelf life" of audit reports. Projects, especially those with a long history, need to implement continuous code checks, otherwise they risk falling victim to attackers armed with AI.
Data for the first half of this year paints a worrying picture. Analysts recorded losses in the Web3 sector totaling approximately $1.32 billion as a result of 344 incidents. After accounting for recoveries, the net damage amounted to roughly $1.2 billion. The main vector of attacks was code vulnerabilities — 204 cases totaling $151.6 million. Particularly noteworthy is the increase in the share of attacks on contracts older than one year. This points to a systemic return of hackers to old codebases, rather than just targeting new projects.
Why are old audits no longer sufficient? A smart contract can remain active for years, but during this time, bug-finding tools evolve, new exploitation techniques emerge, and support teams may let their guard down. The "window of maximum vulnerability" does not close after launch. Re-auditing should become a regular operational requirement. Although a direct link to AI has not yet been proven, the pattern of attacks on old contracts is likely supported by improvements in automated tools capable of finding hidden defects in large volumes of code.
The Zcash Case: Even Verified Code Is Not Immune
A telling example is the incident with Zcash. A critical vulnerability was discovered in the Orchard pool, a key component of private transactions, which had existed since its activation in May 2022 until an emergency fix in June 2026. The bug allowed the undetected creation of an unlimited number of counterfeit ZEC. Due to the pool's privacy features, the team could not prove whether the vulnerability had been exploited previously. This case clearly demonstrates that even code with a long history can contain defects.
AI Agents: Cheap and Effective
Research confirms the growing effectiveness of AI in finding vulnerabilities. On the SCONE-bench benchmark, where agents tested 405 real-world exploited contracts, the result over a year increased from 2% to 55.88% on a subset of vulnerabilities discovered after the model's knowledge cutoff date. The total value of successfully simulated exploits increased from $5,000 to $4.6 million. And the average cost of a full scan of a single contract is just $1.22. As the price decreases and agent capabilities grow, the window between the appearance of defective code and its exploitation will shrink.
Separately, attacks on protocols that have already been shut down or limited in operation are worth noting. For example, an attacker withdrew approximately $2.19 million from Aztec Connect — a solution whose support was discontinued back in 2023. This underscores the need to monitor even "dead" contracts.
My professional conclusion: we are entering an era where security is not a one-time event but a continuous process. Projects that do not adapt to this paradigm will incur losses. AI has become a double-edged sword: it protects, but also attacks with unprecedented speed and efficiency. Regular audits, automated monitoring, and proactive code updates are not a recommendation but a necessity for survival.