- Hackers are using advanced artificial intelligence models to replicate exploits in decentralized finance protocols en masse, cheaply and instantly.
- Traditional smart contract audits are no longer sufficient as the attack vector has moved to infrastructure, human error, and vulnerabilities in the service supply chain.
- Currently, the only effective method of mathematically proving the tamper-proof code is formal verification.
It’s an uneven game. Attackers automate the process of finding vulnerabilities, which allows them to rapidly test thousands of scenarios simultaneously.
Mpost Media Group@mpost_io🔍 @CertiK warns that #AI is tipping the scales in favor of hackers over defenders following a particularly rough stretch of #DeFi exploits this year. “In April, just last month, there were only three days without hacks,” CertiK co-founder and CEO @RonghuiGu said. He attributed
Traditional security audits vs. new techniques
Standard testing and code reviews, while essential, no longer guarantee complete protection against aggressors powered by machine learning algorithms. In this context, Ronghui Gu reminds us of the classic stopping problem, i.e. the fundamental limitation of computer science. No program can predict the behavior of other code in every possible scenario. Even if the AI ​​model runs for several dozen hours and does not detect a vulnerability, this does not constitute evidence of the absence of errors.
Modern engineering requires the implementation of formal verification methods. This is a rigorous mathematical approach that is the only one that allows you to prove that a given smart contract will behave only in the way predicted by its programmers. CertiK points out that code auditing has become a common standard, which paradoxically forced hackers to change their current strategy.
Instead of looking for errors directly in the smart contract logic, attackers attack the operational layer.
Do you currently have cryptocurrencies?
It’s about cryptocurrencies on an exchange, in an application or in a wallet. Don’t treat cryptocurrency ETFs, ETNs and ETPs as ownership.
The survey is anonymous and voluntary. We do not collect your name or IP address. We only publish data in aggregate. Privacy Policy
New threat vectors and conclusions from CertiK reports
In the case of Drift Protocol, the administrator’s rights were taken over by external state actors. Kelp DAO, in turn, suffered from infrastructure failures and management errors, where the perpetrators compromised the configuration of the LayerZero validator. The market currently does not pay enough attention to securing the supply chain and operational procedures, focusing almost exclusively on auditing the applications themselves.
The future of the blockchain ecosystem and coordinated defense
Responding to incidents in distributed networks encounters additional legal barriers. A good example is the incident in which Arbitrum froze approximately $72 million in assets related to the attack on the Kelp DAO. These funds immediately became the subject of complex litigation as third parties brought collection claims for prior terrorism judgments.
Such legal precedents may paralyze future rescue efforts by the blockchain community. Rapid coordination between protocols, exchanges and infrastructure providers is the only way to minimize losses. Criminals operate without geographical and legal restrictions, while defenders must operate within the confines of the law, which drastically increases response times.
