2026

DeFi

Mist

Crypto social media has raised the issue of DeFi vulnerabilities to AI agents. The chief concern is that AI agents are much better at discovering exploit loops, thus putting even solid and large DeFi protocols in danger.
According to Manuel Araoz, all of DeFi is more vulnerable to exploits, mostly due to the use of AI analysis. Araoz, who is the founder of Open Zeppelin, warned that AI is a constant threat to decentralized projects.
<blockquote class="twitter-tweet">
 PSA: I now consider *all* of DeFi unsafe.
 Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds.
 — Manuel Aráoz (@maraoz) <a href="https://twitter.com/maraoz/status/2059413451265441990?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 26, 2026</a>
</blockquote>
He has warned against using even the most established DeFi protocols like Aave, Sky Protocol, and Compound. For now, some investors consider those protocols reasonably safe, but there are still warnings on setting up timelocks and avoiding permissionless operations.
The warning arrives after crypto hacks reached <a href="https://www.cryptopolitan.com/crypto-hacks-hit-record-high-in-april/" rel="noopener noreferrer nofollow">record levels</a> in April, and started to undermine trust in smaller DeFi protocols. However, blue-chip projects still host multiple vaults with their own risk levels.
DeFi lost around $285M in attacks attributed to DPRK hackers, and another $437.4M from unidentified threat actors, according to Dune Analytics <a href="https://dune.com/queries/7346406/11272842" rel="noopener noreferrer nofollow">data</a>. Most of the hacks in 2026 were linked to a bridge verification flaw, followed by <a href="https://dune.com/anu67/2026-defi-hacks-exploits-full-security-analysis" rel="noopener noreferrer nofollow">social engineering</a>.
<h3 id="span-is-ai-creating-a-wave-of-hacks-span">Is AI creating a wave of hacks?</h3>
The warning that AI may exploit DeFi protocols is spreading on crypto social media. The chief fear is that multiple projects may still run vulnerable smart contracts, despite years of audits.
However, according to other analysts, AI may not be that powerful in exploiting flawed contract logic.&nbsp;Instead, exploits always depend on a&nbsp;<a href="https://x.com/0xluude/status/2059443765740507609" rel="noopener noreferrer nofollow">human element,</a> such as errors in signing transactions or access to exposed private keys.
The recent exploits also showed some DeFi protocols had a centralized element that allowed threat actors to take control.
The founder of Slow Mist warned the recent attacks were a mix of logic hacking and social engineering. He called to DeFi teams to <a href="https://x.com/evilcos/status/2059539963864359221" rel="noopener noreferrer nofollow">use AI</a> themselves and simulate attacks and exploits, calling for at least one attack drill each quarter.
<h3 id="span-defi-hacks-slowed-down-again-in-may-span">DeFi hacks slowed down again in May</h3>
After almost daily attacks in April, hacks slowed down in May, returning to a low baseline. In May to date, only around $44M were taken in various hacks, as only smaller protocols were attacked.
<figure class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/05/MayHacksMay272026.png" alt="Is all of DeFi vulnerable due to AI agents finding potential exploit points?" width="1116" height="423">
 <figcaption>
 In May, hacks against DeFi protocols returned to baseline, after the record of KelpDAO in April. | Source: <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">DeFiLlama</a>.
 </figcaption>
</figure>
In May, around 14 attacks were reported, of which the most serious one affected ThorChain. For now, lending protocols are still functioning, though open to the same exploits with flash loans and potential bridging risks.
DeFi suffered a hit from April’s exploits, in combination with weakening ETH prices. As a result, DeFi protocols now hold around $81B, down from over $98B in April. The current TVL levels only reflect nominal prices, and in fact more assets are locked in DeFi as a source of passive income.
Aave, the leading protocol, still holds around $14B, not yet recovered from the withdrawals in April. As Cryptopolitan <a href="https://www.cryptopolitan.com/aave-liquidates-hacker-kelp-dao-exploit/" rel="noopener noreferrer nofollow">reported</a>, the KepDAO exploit was also a major blow to trust in DeFi.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Could AI agents expose DeFi’s next wave of hidden exploits?

Table of Contents

Cryptopolitan_News

Other articles published on May 27, 2026

Join our free newsletter for daily crypto updates!