As AI fundamentally changes the economics of attacks, the focus of attackers shifts from code to people...

Written by: ChandlerZ, Foresight News

In the first half of 2026, the cryptocurrency sector recorded 344 security incidents, with total losses of approximately $1.32 billion.

The Hack3d report released by CertiK in July indicated that excluding last year's single loss of $1.46 billion from Bybit, the security incidents in the first half of 2026 increased by 28% compared to the same period in 2025.

The number of security incidents in the second quarter surged from 145 last year to 194 incidents, marking a year-on-year increase of 34%. The median loss for individual incidents also saw a significant year-on-year increase of 60.6%, reaching approximately $169,000, indicating that even small to medium-sized attacks are now causing significant damage.

When compared on the same basis, the losses of $1.32 billion in the first half of 2026 were actually about 28% higher than in the same period last year

Data source: CertiK

It is noteworthy that incidents causing significant asset losses are increasingly concentrated at the operational level, with attackers more likely to target key management, identity credentials, supply chains, and other operational aspects. While these types of attacks are not the most numerous in terms of incidents, breaching key permissions can often directly affect core project assets, leading to substantial financial losses.

On April 1, 2026, Drift Protocol, one of the largest perpetual contract platforms on Solana, had approximately $285 million stolen within 12 minutes. The attacker disguised themselves as a quantitative trading firm over six months to build trust and ultimately induced a multi-signature signer to pre-sign hidden authorizations. In the same month, cross-chain re-staking protocol KelpDAO suffered losses of approximately $292 million, as the attacker infiltrated the third-party verification infrastructure relied upon by the project, fabricating cross-chain messages. In June, Humanity Protocol lost $36 million due to a phishing email.

None of the three largest security incidents in the first half of 2026 involved vulnerabilities in the smart contract code itself.

The Slow Mist security team stated in an exclusive interview with Foresight News that as of the first half of 2026, among the 182 incidents they recorded, operational failures (key leaks, social engineering, supply chain attacks) only accounted for 53 incidents, making up 29.1%, but caused losses amounting to $732 million, which accounted for 76.6% of total losses.

Security company TRM Labs also released a report noting that in the security incidents of the first half of the year, vulnerabilities related to infrastructure and operations accounted for only about 15% of the total incidents but represented approximately 76% of total losses, far surpassing the impact of over 100 smaller smart contract vulnerabilities.

Monthly loss amounts caused by various attack methods in the first half of 2026

Data source: TRM Labs

Based on this situation, Foresight News engaged in in-depth discussions with the Slow Mist security team and CertiK senior security engineer Yuannan Yang to try to understand the driving factors behind these numbers and the "new problems" emerging in the cryptocurrency security field.

During the interview, it became clear that multiple forces are at play behind these numbers. On one hand, AI is fundamentally changing the economics of attacks, making previously uneconomical attacks profitable. On the other hand, the attackers' targets are shifting from code to people, with social engineering and key management failures replacing smart contract vulnerabilities as the largest sources of loss. The entire security infrastructure built around code auditing is facing unprecedented challenges.

AI is rewriting attack economics

Over the past year, several independent studies have started to quantify the impact of AI on smart contract attacks, with conclusions pointing in the same direction: the cost, speed, and accessibility of attacks are undergoing an order of magnitude change.

Anthropic released benchmarking results from testing 405 real-world exploited smart contracts, showing that the success rate of exploiting contract vulnerabilities after the knowledge base cutoff date (after March 2025) reached 55.8%, with a single scan cost of about $1.22 and simulated an attack value of $4.6 million.

Exploitable vulnerabilities valued at $4.6 million were even found on contracts that the model had never seen before.

In simulated tests, the profits earned from using stolen simulated funds doubled approximately every 1.3 months

Data source: Anthropic

Professor Arthur Gervais and Liyi Zhou from University College London built an agent system called "A1" that can transform any large language model into an end-to-end vulnerability exploitation generator. In tests targeting 36 real historical vulnerabilities (such as access control flaws and logical & signature verification vulnerabilities), A1 collectively extracted about $9.33 million in attack value during the verification process, with a single vulnerability yielding as much as $8.59 million.

This research also reveals a severe economic asymmetry between attackers and defenders; the paper points out that the attacking side only needs about $6,000 to break even and make a profit, whereas the defending side requires an investment of about $60,000 to achieve profitability or break even. This enormous cost gap of up to 10:1 means that previously overlooked attack targets due to an unfavorable cost-benefit ratio are now becoming profitable.

The trends quantified in these studies have already shown direct correspondence on-chain. Groth16 is a cryptographic algorithm used by many zero-knowledge proof protocols to verify transaction legitimacy. In the first half of 2026, a vulnerability in one of this algorithm's settings was exploited on-chain for the first time. Just five days later, a larger scale attack targeting similar vulnerabilities occurred. Aztec Connect, which had been dormant for three years, was exploited twice within those five days by different attackers.

Cryptographic vulnerabilities far exceed conventional code logic errors in technical complexity, requiring professional researchers to spend weeks understanding and reproducing them. The emergence of imitators within five days indicates that the speed of knowledge dissemination regarding attacks is being redefined. UCL's paper also found that the success rate of exploiting vulnerabilities immediately after their disclosure reached as high as 86% to 89%, but plummeted to 6% to 21% after a week.

The attack window is extremely brief, yet for projects without real-time monitoring capabilities, it can be deadly.

Attack patterns are upgrading, faster and more widespread

Aside from accelerating, AI is also expanding the range of targets that can be attacked.

Yuannan Yang, senior security engineer at CertiK, stated that cryptography is the foundation; objectively speaking, in terms of the lines of code involved and mathematical operations, vulnerabilities targeting cryptographic solutions are more technically complex than conventional accounting logic flaws.

AI can handle decompiled code and even low-level bytecode, inferring the core logic of protocols and identifying vulnerabilities in the absence of high-level semantic information. "With AI's assistance, attackers can learn these exploitation mechanisms in just a few days, find new vulnerable contracts, and apply new attack techniques."

In the past, contracts without publicly available source code were nearly black boxes for attackers. Yuannan Yang pointed out that attacks on such contracts are rapidly increasing; of the 186 exploitations in the first half of 2025, there were 19 on non-public contracts, 17 out of 176 in the second half, and 37 out of 257 in the first half of 2026.

A batch of abandoned contracts still holding funds has thus been re-exposed; over 1,400 positions in the old locking contract of DxSale were withdrawn in bulk, and the Truebit contract, which had not been maintained for three years, was also attacked. The teams of these projects had long since disbanded, and the contracts were non-upgradable, with no one to repair them.

To what extent is AI involved in actual attacks? Yuannan Yang believes that in terms of speed (the time window from vulnerability discovery to exploitation) and level of automation, it is difficult to quantify how 2026's attacks differ from those in the previous two years.

The reason is that in most incidents, the specific vulnerabilities were first discovered by the attackers, who may be the only ones aware of that time window. However, this year has seen unprecedented cases demonstrating that attackers are learning and applying new attack vectors at an incredibly rapid pace.

The Slow Mist security team also believes that AI-assisted attacks have become quite common; they observed that AI is widely used in the social engineering and preparation phases of attacks, such as generating phishing pages, fake websites, recruitment materials, social engineering scripts, and malicious code, making the attack content more realistic and personalized. In some public attack samples, traces of AI tools' involvement in content generation can also be clearly seen. Additionally, technologies such as Deepfake voice and video are beginning to be used in social engineering attacks targeting high-value targets.

The most typical public case is the false recruitment attack launched by the Lazarus Group-associated organization HexagonalRodent. The attackers used AI tools like ChatGPT and Cursor to create fake corporate websites, recruitment materials, and communication content and even generated some code to lure Web3 developers into installing malicious programs or leaking sensitive information by offering high salaries.

Moreover, as more project developers utilize AI coding, new attack patterns targeting this model are also emerging. In May, the Socket.dev security research team disclosed a supply chain poisoning operation spanning npm, PyPI, and Crates.io, named TrapDoor. This operation involved over 34 malicious packages that cumulatively released 384 versions, targeting developers in cryptocurrency, DeFi, Solana, AI, and security fields.

Data source: Socket.dev

Attackers exploited each ecosystem's native execution mechanisms (npm's postinstall hooks, PyPI's import entry points, Crates.io's build.rs compiler scripts) to automatically trigger malicious logic during installation or compilation stages, stealing high-value data such as SSH keys, blockchain wallet configurations, cloud credentials, and browser session states.

The fundamental asymmetry in offense and defense is that attackers need only find one breakthrough point, while defenders must cover all angles.

Both sides are accelerating, and the offensive side naturally runs faster.

The biggest vulnerability is always human

In the past few years, DeFi has established a relatively mature code security industry. Before projects go live, smart contract audits, fuzz testing, and formal verification are conducted, and after launch, there are vulnerability bounties and on-chain monitoring, with a significant amount of funding invested in preventing code errors. Despite the widespread application of AI posing many challenges to this process, the security of funds often still comes down to a few specific individuals.

CertiK's data shows that in the first half of 2026, the number of phishing incidents decreased by 52.3% year on year, which seems like good news. However, the monetary losses only decreased by 10.8%, indicating that the attack patterns are concentrating on "few, high-value targets."

Yuannan Yang explained the reasons: unlike traditional phishing that casts a wide net to a large number of users, these attacks specifically target already identified high-value wallets with prior background reconnaissance, tailoring attack plans to the targets. If a target wallet holds hundreds of millions of dollars, taking a few weeks to focus solely on one person becomes economically very feasible from the attackers' perspective.

A typical case is the theft incident involving Drift Protocol, a perpetual contract trading platform on the Solana chain. In the autumn of 2025, a group of individuals claiming to be from a quantitative trading company began contacting the Drift team. They invested over $1 million in real money trading on Drift, participated in community discussions, and spent six months building trust. On April 1, 2026, they induced a multi-signature signer (one of the multiple authorizers controlling the contract funds) to pre-sign a hidden authorization in a seemingly normal transaction.

Within 12 minutes, approximately $285 million of user assets were transferred away.

Attackers used the compromised signer's key and acted swiftly

Data source: PeckShield

Subsequent investigations attributed the attack to the UNC4736 hacking organization linked to the North Korean government, which has been continuously targeting the cryptocurrency and fintech industries since 2018, stealing digital assets through supply chain attacks, social engineering, and malware delivery. Their known major attack incidents include the March 2023 3CX supply chain attack, the $50 million theft from Radiant Capital in 2024, and the $285 million theft from Drift, with aggregate estimated stolen funds of about $335 million.

Drift is an extreme case of social engineering, but there are various forms of operational security vulnerabilities. In the first half of the year, failures in key management and infrastructure emerged densely. The attackers of Kelp DAO infiltrated the third-party RPC infrastructure relied upon by the project and fabricated cross-chain messages to validate the transfer of approximately $291 million; Resolv Labs conducted 18 audits but ultimately lost about $26.85 million due to a breach of AWS cloud key management services; in mid-July, a security incident involving Ostium resulted in over $23.75 million in losses due to the leak of the private key of the administrator account, with hackers infiltrating the off-chain infrastructure related to the protocol's price system.

Social engineering, infrastructure breaches, cloud key leaks, code repository exposures—the attack surface has expanded to every stage where people are present.

Slow Mist has been tracking North Korea-related hacking organizations for years and observed a clear tactical shift, social engineering methods are evolving from quickly gaining permissions to long-term trust building, resulting in longer attack cycles, more resource investment, and greater stealth.

As defenders, the cryptocurrency industry still lacks a universal operational security standard; Slow Mist mentioned in the interview that many teams still equate security with conducting a single code audit before going live, with severely inadequate investment in key management, permission isolation, and employee security awareness.

Some mature projects have already established relatively comprehensive security systems, but the reality is that many small and medium-sized projects lack even the most basic multi-signature configurations and key rotation.

The Slow Mist security team places key management as the top priority for operational security minimum standards in DeFi projects, and key assets and management permissions should employ a multi-signature architecture, establishing standardized mechanisms for key generation, storage, backup, and rotation. They believe, "Operational security is essentially also about human security; the most fundamental change in Web3 security in the first half of the year is that the focus of attacks is shifting from finding code vulnerabilities to breaching people and processes." As social engineering attacks continue to escalate, project teams need to continuously conduct security training and attack-defense drills to enhance members' recognition of phishing, AI-generated content, and other new attack methodologies.

CertiK has already established independent OpSec audit services covering key management architectures, multi-signature configurations, and employee device security policies, while also offering authorized phishing drills and emergency response drills. Yuannan Yang stated that the relevant requests from project teams are steadily increasing.

The security industry itself is being reshaped

As the main battleground of attacks shifts from code to operations, the entire security infrastructure built around code auditing faces re-evaluation.

Analysis by security research institution SigIntZero shows that 89.2% of attacked projects had previously undergone audits. Hacken's Q1 report also pointed out that at least six protocols that passed audits were successfully attacked in the first half of the year, including Resolv Labs which conducted 18 audits but still had vulnerabilities in areas that were never covered by the audits.

Upgrading from one-time audits to continuous security operations is a direction pointed out by both interviewed institutions, focusing on minimizing key permissions and multi-signatures, setting on-chain limits for minting and withdrawal, continuous monitoring, and automatically pausing operations, requiring re-evaluation with each code change.

However, upgrades require funding, and many projects struggle to survive during bear markets. In February 2026, the decentralized lending protocol Zerolend announced its shutdown; its situation can be summarized as comprehensive bleeding, with liquidity continually declining, oracle support ceasing, lending profits compressed, and security threats simultaneously increasing.

Yuannan Yang remarked, "As income and liquidity decline, security costs such as audits, vulnerability bounties, monitoring, and emergency responses become challenging to maintain. Projects choose to cut expenses and operate in a bare-bones manner, or even migrate on-chain deployments, which inherently amplifies security risks until an attack occurs that results in irreparable losses, at which point the project ultimately chooses to shut down."

Under the catalysis of the bear market, the security industry has become more polarized. Institutional-grade projects are actually increasing their security investments under intensifying attacks and compliance pressures, tending to embed audits into the development cycle. The circumstances for small and medium-sized projects are entirely different, lacking liquidity and facing difficulty in financing, security often becomes one of the budgets being cut, and demand for new project audits is also slowing down.

The Slow Mist security team noted that from their actual observations, market cycle changes do influence the demand for security services, but this impact more reflects adjustments in demand structure. For instance, during bear market phases, demand for audits of new projects may slow down. Many budget-limited startups might reduce or delay audits, or even choose cheaper smaller auditing teams, and many projects may use the bear market for strategic positioning.

Additionally, the first reaction of project teams after experiencing an attack is usually to quickly ascertain the attack's status and scope, including determining whether the attack is still ongoing, the affected systems or contracts involved, and the extent of financial losses, and to take urgent measures accordingly, such as limiting risky operations, adjusting permissions, protecting remaining assets, while coordinating internal teams and external security organizations for analysis.

In practice, different projects exhibit considerable variance in their emergency preparedness. Some mature projects may have established monitoring alerts, emergency processes, and collaboration mechanisms in advance, while other projects might only begin establishing response mechanisms after incidents occur.

Conclusion

Phishing, social engineering, key leaks—old problems in the field of cryptocurrency security are repeating every cycle. After discussions with Slow Mist and CertiK, it is clear that what has truly changed in the first half of the year is the economics of attacks; the cost-benefit structure for attackers has fundamentally shifted. AI has simultaneously lowered the costs and barriers to attacks, making old problems reappear more frequently and at a larger scale.

Key storage, cloud permissions, employee security awareness, third-party dependencies—the areas needing protection far exceed just code, and every segment can become a breakthrough point. The security industry is transitioning from code auditing to full-stack protection; how fast this transformation occurs will determine how many old problems will re-emerge in the second half at a new scale.