DeFi

Opus

Aztec

Coin

Blockchain security experts are urging crypto protocols to reaudit their smart contracts as AI tooling is making it easier for hackers to identify vulnerabilities more quickly than ever before.&nbsp;
“Our data argues for continuous review rather than a one-time audit,” TRM Labs head of policy Ari Redbord told Cointelegraph, adding that “attack techniques are moving faster than a single audit from launch day can account for.”
<blockquote>
 “An audit built for last year’s attack patterns leaves a protocol exposed to this year’s as bad actors are changing up.”
</blockquote>
CertiK reported Monday that <a href="https://cointelegraph.com/news/crypto-hacks-fell-47-percent-in-h1-but-ecosystem-is-no-safer-certik" rel="noopener noreferrer nofollow">hackers stole another $1.32 billion</a> in the first half of 2026 and have adopted increasingly sophisticated strategies in response to strengthened security measures across the industry.
One of those strategies has been to revisit old codebases, CertiK said, adding that the attackers' efforts have likely been “aided by improved automated tooling for identifying latent vulnerabilities at scale.”
One of the most recent incidents involved privacy-focused blockchain Zcash, where Shielded Labs security engineer Taylor Hornby found a major <a href="https://cointelegraph.com/learn/why-zec-fell-after-zcash-orchard-bug-fix" rel="noopener noreferrer nofollow">security vulnerability</a> using a custom auditing agent powered by Anthropic’s Claude Opus 4.8. The bug has since been patched.
The security vulnerability, which existed for four years, could have enabled undetectable counterfeiting inside the Orchard shielded pool, one of the network’s key privacy features.
“The window of maximum vulnerability does not close after launch,” CertiK warned. “Projects operating legacy infrastructure should treat reauditing as a recurring operational requirement rather than a one-time exercise conducted at deployment.”
In December, Anthropic <a href="https://www.anthropic.com/research/smart-contracts" rel="noopener noreferrer nofollow">conducted</a> a study finding that AI agents found $4.6 million worth of exploitable vulnerabilities in smart contracts. Meanwhile, there is more than <a href="https://defillama.com/" rel="noopener noreferrer nofollow">$72.3 billion</a> worth of crypto locked across hundreds of DeFi protocols, giving hackers plenty of incentive to exploit vulnerable smart contracts.<img alt="" height="754" src="https://s3-images.ctmedia.io/media/content/screenshot-2026-07-09-at-15-34-26-slowmist-hacked-slowmist-zone.png" width="814">
SlowMist's estimate of total crypto losses from blockchain hacks. Source: <a href="https://hacked.slowmist.io/" rel="noopener noreferrer nofollow">SlowMist</a>
<h2 id="defunct-crypto-protocols-targeted">Defunct crypto protocols targeted</h2>
On June 14, hackers exploited a smart contract vulnerability to <a href="https://cointelegraph.com/news/aztec-exploited-21-million-previous-hack-slowmist" rel="noopener noreferrer nofollow">steal $2.1 million</a> from the Aztec Connect, which had been shut down since March 2023.
Five days later, a smart contract on the decentralized exchange mySwap was exploited for $300,000, even after the mySwap user interface had been closed to new liquidity deposits for more than six months.
A more fortunate event took place in May, when a white hat, known as “0xflorent,” <a href="https://cointelegraph.com/news/whitehat-helps-recover-2m-from-2016-ico-smart-contract" rel="noopener noreferrer nofollow">helped recover</a> 1,003 Ether (ETH) worth over $1.72 million from 48 investors involved in the Hong Coin (HONG) initial coin offering in 2016.
Related: <a href="https://cointelegraph.com/news/all-defi-unsafe-ai-security-debate" rel="noopener noreferrer nofollow">‘All DeFi unsafe’ claim sparks AI security debate after April hack surge</a>&nbsp;
The ICO failed to launch after missing its funding target, and the funds remained locked in the smart contract due to a bug in the auto-refund function.&nbsp;
<h2 id="reaudits-only-part-of-the-equation-trm-says">Reaudits only part of the equation, TRM says</h2>
The work doesn’t stop with hardening the codebase and infrastructure, Redbord said, explaining that the broader industry and regulators need to continue finding ways to mitigate malicious cyberactivity from North Korea and disrupt Chinese money laundering networks:
<blockquote>
 “Protocols can lock their doors, but someone still has to go after the actor breaking in.”
</blockquote>
Features: <a href="https://cointelegraph.com/features/defi-hacks-institutional-confidence-risks-outpace-yields" rel="noopener noreferrer nofollow">DeFi hacks shake institutional confidence as risks outpace yields</a>&nbsp;

AI is shortening the shelf life of crypto security audits, researchers warn

Table of Contents

Cointelegraph

Other articles published on Jul 9, 2026

Join our free newsletter for daily crypto updates!