In September 2026, Chainalysis confirmed what we all knew when it published a figure that should have been front-page news across every crypto publication.
Instances of malware instructions written directly into on-chain transactions and smart contracts had risen 440% in under a year, climbing from roughly two cases a day to eleven.
The cause wasn’t a new vulnerability class or a novel cryptographic break, but the cost of admission to hack.
It was the mid-2025 release of powerful Chinese open-source AI models shipped without meaningful guardrails against generating malicious code. The cost of finding and exploiting vulnerabilities has collapsed, while the cost of defending against them has not.
Which leaves builders with a blunt choice:
Hack yourself first, with the same class of tools your attackers are using, or wait to be hacked by someone who did.
The New Economics of Attack
The technique Chainalysis documented is called a “blockchain dead drop” — attackers embed command-and-control instructions inside blockchain transactions, which malware on an infected device then retrieves.
Because blockchain records are immutable and censorship-resistant, defenders can’t simply take down a server to break the chain of communication, as they would with conventional C2 infrastructure.
The AI angle matters because it grants operational freedom. Open-source models can run locally, be modified, and be stripped of safety restrictions entirely.
As Chainalysis noted, this gives malicious developers greater control and more privacy, because they don’t have to route their code through large cloud providers that monitor for abuse — whereas OpenAI, Google and similar operators can cut off access the moment they detect misuse. There’s no API key to revoke, no account to ban, no rate limit to hit.
The result is that vulnerability discovery has become a volume game. What once required a skilled human researcher to spend weeks on manual code review can now be attempted continuously, in parallel, against thousands of targets by anyone with a decent GPU.
Core Lightning’s maintainers experienced the defensive side of this directly in August 2026, receiving a flood of AI-generated CVE reports from multiple sources over roughly ten days — enough to trigger an emergency release and a two-week disclosure embargo. Several of those reports described genuine, exploitable flaws.
Google faced the same deluge, revising its Open Source Software Vulnerability Reward Program in March 2026 after a “massive surge” in AI-generated submissions, many containing hallucinated exploit paths that still consumed real triage hours.
The Damage Is Already Substantial
The scale of what’s at stake isn’t theoretical. Obviously, some companies will blame AI for their own incompetence, but most breaches likely stem from AI-powered attacks that hunt for flaws in code logic or loops that can be exploited.
Bybit’s February 2025 breach remains the largest crypto theft ever recorded at roughly $1.4 billion, after attackers compromised a third-party developer’s workstation and injected malicious code into the transaction signing process — making a fraudulent transfer appear legitimate to human reviewers.
2026 has followed a pattern of more frequent, more surgical attacks. CertiK’s Hack3D report counted $1.32 billion stolen across 344 on-chain incidents in the first half of 2026 alone, while TRM Labs tracked 207 hacks over the same period.
The largest were KelpDAO’s bridge compromise (~$292 million, April) and the Drift Protocol takeover (~$285 million, April), both linked to North Korean operations — with DPRK-affiliated groups accounting for roughly 66% of all funds stolen in H1.
A single individual lost $282 million in January to a phishing campaign impersonating Trezor support.
The Problem isn’t Altcoin Only
While these are all altcoin examples, the Bitcoin ecosystem hasn’t been immune either.
While the main chain continues to soldier on without any issue, the Liquid side-chain has not been so fortunate, having all its liquidity withdrawn in a hack, 4000 BTC gone in an instant.
Since the initial breach and patch, the Liquid Network has recovered 3400 BTC through on-chain negotiations with the hacker, but it remains short on full 1-1 backing for all L-BTC issued.
Then there’s the Coldcard firmware flaw, which deserves special attention because it wasn’t an exchange breach or a social engineering play. A 2021 code change caused seed generation to quietly fall back to a weak software randomness source, leaving affected Mk3 devices with roughly 40 bits of entropy instead of 128.
On July 30, 2026, attackers drained 1,196 Bitcoin addresses in 41 minutes. Galaxy Research later verified 1,596 BTC taken from roughly 7,300 addresses across three attack waves, with a suspected fourth wave pushing the total toward 2,055 BTC — around $130 million. The flaw sat undetected in open-source code for over five years.
Smaller incidents we’ve seen were from Boltz, a non-custodial Bitcoin swap service, which says it is disabling its service until further notice after a rise in AI-assisted hacking attempts.
On September 14, Swiss Bitcoin Pay shut down services due to constant attacks on its platform.
This week, Blink Wallet also suspended service after attacks on its custodial accounts.
Why Blockchain Gets Special Attention?
Attackers optimise for return on effort, and blockchain infrastructure offers a combination of properties that almost nothing else in software does.
The payload is the target.
Most enterprise breaches yield data that must then be monetised — sold, ransomed, or used for downstream fraud. A blockchain exploit yields the asset directly, in an instantly transferable, globally liquid form.
There is no fencing step.
Settlement is final. There is no chargeback, no wire recall, no fraud department that can reverse the transaction once it confirms. The window between exploitation and irreversible loss is measured in blocks, not business days.
The code is the vault.
In traditional finance, a software bug is one layer of a defence-in-depth stack that includes legal recourse, insurance, regulatory backstops and human review. In crypto, the smart contract or the signing logic is frequently the entire security model.
Everything is public.
Attackers can read the deployed contract, simulate transactions against a forked mainnet, and test exploits offline at zero cost and zero risk of detection before ever touching production.
Value is concentrated.
A single bridge contract or federation reserve can hold hundreds of millions of dollars, making the expected value of a successful exploit enormous relative to the effort required.
Open Source vs. Closed Source: Which Is Actually More Exposed?
The conventional answer — that open source is safer because more eyes review the code — deserves scrutiny in an AI-accelerated environment.
Open-source projects face a real asymmetry.
Attackers can feed the entire codebase directly into a model and run automated vulnerability discovery at will.
Worse, when a patch ships, the diff itself becomes an attack map: anyone can compare the before-and-after, reverse-engineer what was protected against, and then hunt for unpatched nodes.
This is precisely why Core Lightning imposed a fourteen-day embargo on technical details while urging operators to upgrade — the maintainers were explicitly racing the rediscovery window.
But closed source is not meaningfully safer, and may be worse.
Obscurity delays discovery; it doesn’t prevent it. Attackers can still decompile binaries, fuzz APIs, and probe behaviour — and modern models are increasingly capable of reasoning about decompiled code. Meanwhile, the defensive benefit of open review is entirely forfeited.
The Bybit breach didn’t require source access. Neither did the Trezor impersonation phishing that cost one person $282 million.
The honest framing is that the open/closed distinction matters far less than whether a team is actively running adversarial analysis against their own code.
Open source gives you the potential for broad review, but Coldcard’s entropy flaw proves that potential isn’t self-executing — five years of public availability didn’t surface it.
What surfaced it was someone finally looking with the right tools.
Hack Yourself First
The strategic conclusion is uncomfortable but unavoidable: if frontier models can find vulnerabilities in your codebase, you need to be the one running them.
This means treating adversarial AI analysis as continuous infrastructure, not an annual event. Traditional audits produce a point-in-time snapshot that’s typically expensive and stale within a release cycle or two. Model-assisted review can run against every commit, every pull request, every dependency update — catching regressions and newly introduced flaws at the point of introduction rather than months later.
It means red-teaming the full stack, not just the contracts.
The data is unambiguous:
The biggest losses in 2026 came from stolen keys, compromised developer workstations, and social engineering — not clever smart contract bugs. Bybit’s attackers went through a third-party developer’s machine. The largest individual loss came from a fake support interaction. Adversarial testing needs to cover signing infrastructure, deployment pipelines, admin access paths, third-party dependencies and the humans operating all of it.
It means assuming your attackers have already done this. Given that unrestricted open-source models are freely available and cheap to run, the realistic baseline assumption is that any reasonably valuable protocol has already been fed through several of them by people who don’t intend to file a responsible disclosure.
Making Audits Publicly Verifiable
If model-assisted security review becomes standard practice, the next question is how users can distinguish real rigour from marketing. A few approaches are emerging that companies should adopt proactively.
Publish the methodology, not just the verdict. Which models were used, at what versions, against which commit hashes, with what prompting approach and scope. A claim of “AI-audited” means nothing without these specifics; a reproducible methodology means a third party can run the same analysis and compare findings.
Commit audit artefacts on-chain. Hashing an audit report and anchoring it to a timestamped transaction gives an immutable record of what was reviewed and when — preventing quiet revision after an incident and letting users verify that the audit predates the deployment they’re trusting.
Maintain a continuous, public security log. Rather than a single PDF, a running record of scans performed, findings triaged, false positives dismissed and fixes shipped. This converts security from a marketing claim into an observable track record.
Disclose the triage burden honestly. Core Lightning’s transparency about receiving a flood of AI-generated reports, most of which required human validation, was genuinely useful signal. Teams that publish how many reports they receive, how many prove valid, and how quickly they resolve them give users real information about operational maturity.
Commit to embargo timelines in advance. Publishing a disclosure policy — how long details stay private after a patch, and what triggers early release — lets operators know what to expect before a crisis, rather than being asked to extend blind trust in the middle of one.
The White versus Blackhat Race Is On
The 440% surge Chainalysis documented is not a temporary spike tied to one model release. It’s the new baseline. Capability floors don’t move back down, and the models available to attackers will keep improving while remaining free, local and unmonitored.
For anyone building on blockchain infrastructure, the calculus has changed permanently.
Security is no longer a milestone you clear before launch — it’s an adversarial process running continuously against you, at machine speed, by parties who have already automated what your annual audit does once a year.
The only rational response is to run the same tooling against yourself, more often and more aggressively than they do, and to make the results verifiable enough that users can tell the difference between a team doing the work and a team claiming to.
Hack yourself, thoroughly and continuously, or accept that someone else will do it for you — and they won’t file a report.
