The blockchain security firm’s May 15 alert points to a shift in the economics of crypto attacks. Vulnerability hunting that once required time, specialist knowledge and manual review can now be accelerated by AI systems trained to recognise recurring weaknesses across thousands of contracts. That makes older DeFi infrastructure more exposed, especially where projects have forked code, delayed upgrades or assumed that contracts left untouched for years are no longer attractive targets.
Legacy contracts are a particular concern because many were written before today’s audit standards, testing tools and exploit playbooks became common. Some still control liquidity pools, vaults, bridges, governance functions or token permissions. Others sit inside broader DeFi systems as dependencies that users do not see but attackers can map through blockchain data. Since deployed smart contracts are often difficult or impossible to alter, dormant weaknesses can remain live long after a project’s main development cycle has moved on.
CertiK’s warning follows a sharp deterioration in the security climate across DeFi. April 2026 produced one of the heaviest monthly loss figures for the sector since 2022, with estimates across security trackers placing crypto-related losses above $600 million. Large incidents involving Drift Protocol and Kelp DAO accounted for a substantial share of the damage, while smaller attacks continued to affect bridges, lending platforms, liquidity protocols and wallets. The concentration of losses underscored how a handful of successful exploits can unsettle confidence across the wider market.
The new risk is not that AI has created an entirely unfamiliar category of smart contract bug. The greater danger is scale. Attackers can use automated systems to compare code patterns, locate clones of vulnerable contracts, trace outdated dependencies and prioritise targets where the potential payout is high. For criminal groups, this lowers the cost of reconnaissance and shortens the time between identifying a weakness and launching an attack.
CertiK co-founder Ronghui Gu has described the changing balance as an “unfair game” for defenders, because attackers can use AI cheaply while protocols must protect live systems holding large pools of user funds. As audits improve, attackers are also widening their focus beyond code defects to operational security, supply chains, private keys, compromised devices and governance weaknesses. This creates a more complex threat model in which a secure contract may still be exposed through the people and infrastructure around it.
Security specialists say the most vulnerable projects are not always the largest. Smaller protocols, abandoned forks and fast-growing platforms with limited monitoring can present easier opportunities. Attackers can search public blockchains for contracts with high balances, outdated compiler versions, known library patterns or permission structures that resemble previously exploited systems. Once a target is identified, AI-assisted tools can help simulate attack paths, generate proof-of-concept transactions and refine exploit sequences.
This development places renewed pressure on DeFi teams to treat old contracts as active liabilities rather than archived code. Periodic re-audits, formal verification, real-time monitoring and circuit breakers are becoming baseline expectations for platforms holding user assets. Projects also face growing pressure to disclose contract dependencies clearly, maintain upgrade paths where feasible and retire unused contracts that retain permissions or funds.
AI is also becoming part of the defensive response. Auditors now use machine-learning systems to flag suspicious code patterns, detect anomalies, prioritise manual review and compare new deployments with known vulnerabilities. These tools can improve speed and coverage, but they are not a replacement for human judgment. AI can produce false positives, miss context-specific economic flaws and struggle with complex cross-chain logic, where market behaviour and contract execution interact in unpredictable ways.
The broader concern is that DeFi’s open design gives both sides the same visibility. Transparency allows users and auditors to inspect code, but it also gives attackers a permanent map of deployed contracts, balances and transaction histories. AI intensifies that asymmetry because malicious actors need to find only one exploitable path, while defenders must secure every path that could lead to fund loss.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
