The AI Exploit Economy: Is Crypto Getting Easier to Hack Than to Secure?

The rapid expansion of AI across software development and financial infrastructure is introducing a new dimension to crypto security, where the ability to identify vulnerabilities may increasingly outpace the systems designed to prevent their exploitation. As developers deploy applications faster, automated agents gain greater authority over digital assets, and attackers acquire more capable tools for analysing publicly accessible code, the balance between offensive and defensive capabilities is coming under pressure.

The recent Binance breach offers a useful starting point for examining that imbalance, raising a broader question about whether AI could make weaknesses cheaper and faster to exploit than they are to detect, repair and contain.

What the Binance Hack Reveals

The October 2026 theft of approximately $6.4 billion from Binance became the largest reported crypto hack on record, surpassing earlier incidents involving LuBian and Bybit. According to Binance's preliminary findings, attackers spent months compromising employee devices and internal systems before gaining access to wallet-signing operations. Although compromised AI tooling formed part of the intrusion, investigators have not established that an autonomous AI agent carried out the theft.

<iframe src="https://www.houseofchimera.com/embed/charts/largest-crypto-hacks-on-record" title="Largest crypto hacks on record, 2014–2026" width="100%" height="420" style="border:0" loading="lazy"></iframe>
<p>Chart: <a href="https://www.houseofchimera.com/labs/research/the-ai-exploit-economy-is-crypto-getting-easier-to-hack-than-to-secure#chart-largest-crypto-hacks-on-record">Largest crypto hacks on record, 2014–2026</a> by Chimera Labs, House of Chimera (<a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>)</p>

The historical record shows that crypto's largest losses have frequently involved compromised credentials, signing authority and infrastructure rather than smart contract vulnerabilities alone. Many of these incidents also highlight how human error and compromised access can undermine security. Even a well-audited protocol can lose funds if an attacker gains access to employee accounts, steals signing credentials or compromises internal systems. While these incidents differ in their underlying mechanisms, they demonstrate how vulnerabilities beyond smart contract code can lead to substantial financial losses.

How the Attack Surface Grew

AI now lets a developer assemble a website, generate contract code, connect a wallet and prototype a working application in a fraction of the time these tasks once demanded. For a small crypto team, this removes a serious barrier to launching, though it leaves untouched the obligation to understand what the product can do with other people's money.

GitHub's 2026 Octoverse report shows how far beyond crypto the shift reaches, with more than 40% of pull requests in September beginning with an agent, up from 17% in March. The figure covers all of GitHub rather than DeFi, but it shows how quickly AI became part of ordinary software production.

Veracode's fall 2026 testing found that roughly 38% of evaluated AI code generation tasks produced a known security vulnerability, down from about 44% in its July 2026 report. Its tests covered four conventional programming languages and selected weakness categories, not live Solidity deployments, so for Solidity specifically the better reference is a separate 2026 study of AI generated smart contracts, which found that code could be syntactically correct and functionally complete and still contain serious security flaws.

None of this makes an AI-written contract less secure than a human-written one, since human developers ship bugs of their own and AI catches a share of them. The problem lies in pace, because a feature built in an afternoon can still require threat modelling, dependency checks, adversarial testing and a review of who can call privileged functions. A DeFi app's attack surface also runs past its own contracts, into oracle dependencies, bridge contracts, front-end delivery and signing infrastructure, where every integration adds a trust assumption nobody has verified.

Alongside that growth in code, the same tooling is handing software direct authority over funds. A chatbot that suggests a trade can be ignored, but an agent wired to a wallet, a trading account, or a signing service executes it, so the model's output results in a financial action.

In its first quarter 2026 report, Olas said its Polystrat agents had completed nearly 14,700 trades across 1,750 prediction markets, and the project's on-chain activity counters showed more than 21 million cumulative agent transactions by early November 2026. The first-quarter report also broke cumulative activity down into 12.59 million transactions from trader agents, 2.51 million from prediction brokers, and 79,289 from market creators.

Each of those figures counts on-chain actions inside the Olas ecosystem, not trades, investment decisions or activity across the wider market. Even so, the weight of trading activity underscores why wallet permissions and contract interactions deserve attention, since automated systems already operate at a scale where a single repeatable flaw can compound.

Outside Olas, Dune counted 15.3 million agent payment transactions in August 2026, mainly over x402. Those are attributed to software payment rails, so the count says nothing about how many of the payments an AI model independently chose to make.

An agent rebalancing a portfolio may need market data, a signing service, API keys, token allowances, or a funded wallet, and the security exposure lies more in that authority than in any transaction count. Some of those permissions are narrow and revocable; others allow far more than the user realises. The JaredfromSubway attack shows how costly a broad one becomes once granted: the attacker only needed 66 fake token contracts and an automated bot to approve expenditures, bypassing any human or system review in the process.

An AI agent with broad wallet permissions would carry the same contract risk plus agent-specific risks, including indirect prompt injection through the data feeds it reads, spoofed or malicious tool responses, and state changes triggered by non-deterministic output that nobody reviewed. OWASP's agentic security research has documented how untrusted inputs can redirect tool-using agents in other settings, where the usual cost is a wrong answer or a leaked file, whereas in DeFi the same failure results in a signed transaction.

Taken together, the two trends leave more software in production than anyone can verify and more of it able to move money without a person approving each step. Smart contract auditing reaches neither problem, because a perfectly audited contract cannot stop a bad decision by an authorised signer, so the agent, its inputs and its permissions now sit inside what has to be secured.

The Falling Cost of Finding a Weakness

An October 2026 paper, CyberChainBench, sought to measure the cost to an attacker of finding a weakness worth exploiting, testing agents against historical DeFi incidents on isolated blockchain forks. Its strongest configuration succeeded in 43.7% of exploitation tasks, compared with 37.5% for vulnerability detection and 23.4% for patching. The top agent generated $57.4 million in simulated exploit profit across 200 cases that occurred after the model's knowledge cutoff, at an average model cost of $2.39 per case.

Those profits were earned in recreated historical environments where agents had been given evaluation context, so none of them describes real theft. The $2.39 likewise covers model usage alone and excludes the research, infrastructure, capital, transaction costs, and operational risk that a live attack would entail. Because the three percentages come from non-identical test subsets, with patching evaluated on the narrowest, they also cannot be read as a controlled head-to-head comparison.

EVMbench, which OpenAI built with Paradigm, achieved a 71% score in its exploit evaluation, inviting the same misreading. The figure does not mean a 71% chance of compromising an unfamiliar live protocol, and OpenZeppelin later challenged the benchmark's ground truth, identifying at least four high-severity findings it judged not exploitable.

When a16z tested an agent against 20 historical price manipulation exploits, a more complex class of attack, it first appeared to succeed in half of them. Researchers then found it had been reading transactions from after the attacks, effectively seeing the answers, and blocking that leakage cut success to 10%. Specialised guidance drawn from the incidents lifted it back to 70%, reflecting more assistance than independent discovery.

Across all three benchmarks, agents handle meaningful parts of the exploit workflow, mostly where the weakness or attack pattern is already known. Finding a vulnerability, assembling a profitable sequence of transactions and succeeding against a live system remain separate problems, and the distance between them is shrinking in places without closing everywhere.

The market for exploits can shift before that distance closes, because what automation mainly gives an attacker is a cheaper way to examine more targets and discard the unpromising ones. Difficult exploits have traditionally demanded scarce expertise and lengthy investigation, which has drawn attention toward larger pools of funds. If agents can automate initial code review, trace transactions, test known attack patterns and draft proof-of-concept exploits, the cost of evaluating one more target falls, and a protocol that once looked too small to justify a specialist's time becomes worth screening.

A DefiLlama Research analysis conducted by Firepan classified 60% of 1,236 historical crypto security incidents as potentially discoverable and exploitable by current AI agents, which gives a rough sense of where that pressure might land. Those incidents accounted for only 23% of the $20.12 billion in recorded losses, and the median loss in the reproducible group was about $545,000, against $3.3 million for incidents classified as not reproducible.

Because the analysis is a retrospective classification by vulnerability archetype rather than 1,236 replayed agent runs, it offers no evidence of AI-driven exploitation in the wild. It does show that most recorded incidents, counted one by one, fall in the cheap and repeatable part of the threat landscape that automation handles best.

<iframe src="https://www.houseofchimera.com/embed/charts/ai-reproducible-crypto-hacks" title="Crypto hacks current AI agents could reproduce, share of incidents vs losses" width="100%" height="420" style="border:0" loading="lazy"></iframe>
<p>Chart: <a href="https://www.houseofchimera.com/labs/research/the-ai-exploit-economy-is-crypto-getting-easier-to-hack-than-to-secure#chart-ai-reproducible-crypto-hacks">Crypto hacks current AI agents could reproduce, share of incidents vs losses</a> by Chimera Labs, House of Chimera (<a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>)</p>

If screening costs drop significantly, volume-focused attackers and high-payout specialists will no longer target the same protocols. This shift allows the former to continuously scan newly deployed contracts for lower-profit opportunities. While gas fees, liquidity, and competition still matter, the number of viable targets will surge, even if the success rate for any single project remains low.

Defense Runs on a Longer Clock

That pressure is hard to answer to, partly because a working exploit is judged on a single outcome: whether it produced the unintended transfer or profit. A patch has to meet a longer list of conditions, since it must block the exploit, preserve intended behaviour, handle edge cases, and remain safe as it interacts with the rest of the protocol, all without breaking legitimate transactions or introducing a different weakness.

That asymmetry is part of why CyberChainBench's patching scores trailed its exploitation scores, and why more vulnerability reports do not automatically make a protocol safer. Someone has to validate each finding, judge whether it is exploitable, then fix, test and deploy it safely.

<iframe src="https://www.houseofchimera.com/embed/charts/ai-agents-vs-real-defi-hacks-success-rate-by-task" title="AI agents vs real DeFi hacks: success rate by task" width="100%" height="420" style="border:0" loading="lazy"></iframe>
<p>Chart: <a href="https://www.houseofchimera.com/labs/research/the-ai-exploit-economy-is-crypto-getting-easier-to-hack-than-to-secure#chart-ai-agents-vs-real-defi-hacks-success-rate-by-task">AI agents vs real DeFi hacks: success rate by task</a> by Chimera Labs, House of Chimera (<a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>)</p>

CyberChainBench reported higher success rates for exploitation than patching, although the tasks were evaluated on different subsets, so the results cannot be directly compared. A defender has to confirm a fix preserves normal behaviour, and a protocol may need governance approval or a safe upgrade path before anything ships, obligations an attacker never faces, since nothing requires the application to keep working once the funds are gone. For small teams, the binding constraint therefore sits after detection, in understanding a suspicious pattern and resolving it before an attacker finds the same path.

The tools that reconstruct exploits can also review contract changes, simulate hostile transactions, prioritise findings and test candidate patches, so automation can relieve that constraint as readily as it creates it. EVMbench and CyberChainBench were both built to measure both defensive and offensive tasks.

Code scanning also stops short of the execution layer, where most of the protection comes from limiting what an agent is allowed to do in the first place. If each agent works from its own isolated wallet with capped approvals, a manipulated agent can lose only what it was given, and a circuit breaker can halt unusual on-chain activity before anyone has to spot it. Limits of that kind sit outside the model, which matters because an agent's authority should not depend on its willingness to follow instructions.

Whether those protections become default infrastructure for small developers, or stay expensive extras for major protocols, will decide much of the outcome. Where security checks are automated into deployment from the start, the tooling that lowers the cost of shipping also lowers the cost of verifying, and the pressure starts working in defenders' favor.

Conclusion

There is not yet sufficient evidence that crypto has become easier to hack than to secure. The benchmarks discussed here measure AI performance under controlled conditions, while many of the largest historical losses have involved stolen keys, compromised signers and operational failures rather than smart contract vulnerabilities alone. What the evidence does suggest is that AI could change the cost of finding and exploiting weaknesses, particularly as automated tools make it easier to examine more potential targets. Smaller protocols that previously attracted little attention could become worth investigating, even when the likelihood of a successful exploit remains low.

Developers also face growing pressure as AI allows code to reach production faster, while security reviews, testing and remediation still require time. The same tools can help defenders detect vulnerabilities, simulate attacks and test potential fixes, although identifying a weakness does not guarantee that it can be resolved quickly or safely. As autonomous agents gain greater authority over financial transactions, limiting wallet permissions, controlling access to signing infrastructure and restricting potential losses become increasingly important. The evidence leaves the outcome uncertain, but it shows why security practices must keep pace with faster development and cheaper vulnerability discovery.