In 2026, artificial intelligence tools began identifying security vulnerabilities that had persisted undetected in cryptocurrency systems for years. The trend has raised concerns about both the defensive and offensive applications of AI in crypto security.
Researcher Taylor Hornby, working for Shielded Labs, used Claude Opus 4.8 in a custom audit agent to uncover a flaw in Zcash's Orchard shielded-pool circuit that dated to 2022. The vulnerability could theoretically create unlimited counterfeit ZEC without detection. Although no theft was documented, developers patched the flaw within days of discovery. The bug had remained undetected for approximately four years.
A more significant incident involved Coldcard, a hardware wallet manufacturer. Beginning July 30, attackers swept bitcoin from wallets affected by a firmware weakness traced to 2021 that left some recovery seeds less random than intended. Estimates reached roughly 1,600 to more than 1,800 BTC across thousands of addresses, valued at over $100 million. Coinkite, Coldcard's manufacturer, acknowledged the possibility that unrestricted AI models had been used to identify the vulnerability, which had remained exploitable for five years.
Attackers have also begun exploiting AI systems themselves. An attacker posted Morse-code text that an AI agent decoded into an instruction, triggering the transfer of approximately 3 billion DRB tokens worth between $150,000 and $200,000. A similar trust-layer problem subsequently affected 14 user wallets, with reported losses ranging from approximately $150,000 to $440,000.
Chainalysis reported that malicious instructions embedded on public blockchains jumped 440%, from roughly 2.06 per day to 11.1, suggesting broader shifts in attack economics. The data firm linked approximately $36.7 million in thefts to attacks against protocols with unverified contracts, where attackers must first decompile deployed bytecode. State-linked actors associated with North Korea and Iran accounted for roughly two-thirds of newly observed malicious onchain activity by the second quarter of 2026.
