Crypto's Worst Hacking Year Is the Cheap One
Every crypto hack you have read about this year was made by hand. That is the fact worth sitting with, because the constraint that shaped the entire threat model is about to disappear.
Speaking at the Wyoming Blockchain Symposium this month, Global Settlement Network chief executive Ryan Kirkley described the bridge exploits that dominate crypto headlines as "pennies" — not because the sums are small, but because they represent what attackers can manage when a human has to sit at a keyboard and choose a target. Kirkley's warning was about scale: agents let an attacker go after everyone at once, rather than picking the few victims worth the effort.
Web3 Foundation's Bill Laboon agreed on the panel that the efficiencies making decentralized systems easier to use cut in both directions.
They are right, and the reasoning is more boring and more alarming than most AI-security discourse.
Attack has always been rationed by attention, not capability
Consider how a serious exploit actually gets built. Someone reads a protocol's contracts. Someone models the state transitions, finds an ordering assumption that does not hold, writes a proof of concept, tests it against a fork, works out the extraction path, and prepares the laundering route. That is weeks of skilled labor.
Skilled labor is scarce. So attackers do what anyone with scarce labor does — they concentrate on the highest-value targets. Bridges. Large lending markets. Custodial hot wallets. The protocols holding nine figures.
This is why the small protocol with sloppy code and $4 million in it usually survives. Not because it is safe. Because nobody has gotten around to it.
Remove the labor constraint and that entire logic collapses. A $4 million target is no longer beneath attention when discovering the bug costs a few dollars of inference and the exploit template is reusable.
The $643 million was hand-made
Look at the first half of 2026 with that lens. North Korea-linked threat groups accounted for roughly $643 million, about 66% of all stolen crypto funds in the period. The single largest incident, a roughly $295 million theft from Drift Protocol, was one operation against one target.
Two thirds of the damage came from a state-sponsored unit with a payroll. That is a labor-intensive industry with a hiring pipeline, training costs, and a finite number of people who can do the work.
Now picture the same objective pursued without the payroll. Not smarter attacks — the same attacks, run against ten thousand contracts simultaneously, with the scan and the triage and the first-draft exploit generated automatically, and humans reserved only for the handful of leads that look promising.
The dollar total does not need a breakthrough in model capability to multiply. It only needs the tedium removed.
Bug bounties are priced in human hours. Discovery no longer will be.
Here is the asymmetry that keeps me up.
Defensive security in crypto is priced on scarce human expertise. An audit from a reputable firm runs tens of thousands of dollars and takes weeks, because it consumes senior engineer time. A bug bounty pays out on findings, but the finding still requires a researcher who chose to look at your protocol instead of someone else's.
Both of those costs are anchored to human labor. Neither falls when inference gets cheap, at least not proportionally — an audit firm running agents still charges for the partner who signs the report and the liability that comes with it.
The attacker has no such anchor. There is no report, no client, no liability, no reputational floor under the price. Whatever fraction of vulnerability discovery becomes automatable transfers directly to the attacker's margin, and only partially to the defender's.
Defenders will absolutely deploy agents too. Continuous monitoring, automated invariant checking, anomaly detection on mempool activity — all of it improves. But the defender must find every flaw and the attacker needs one, and cheapening search helps whoever benefits more from volume.
The agents already have wallets
This is not a 2030 problem, and the reason is that agentic systems have already been handed spending authority.
Coinbase's x402 protocol processed about 14 million agent-initiated transfers in a recent 30-day window, with Base handling roughly 7.3 million and Polygon about 5.6 million, settled almost entirely in USDC. Cloudflare shipped a monetization gateway last month letting site owners charge for resources with stablecoin settlement at the edge. AWS previewed agent payments in Bedrock built with Coinbase and Stripe.
Each of those is a legitimate, useful piece of infrastructure. Each of them also means autonomous software now holds keys and moves value without a human approving the individual transaction.
Kirkley's phrase for the underlying error was a "fatal flaw in almost everything agentic today" — the built-in assumption that agents are benign. Systems designed around that assumption authenticate the agent, not the intent. And a compromised agent with legitimate credentials is a categorically harder problem than a stolen private key, because nothing about its behavior is unauthorized.
The physical attacks are the tell
Something else in the 2026 data deserves more attention than it got. Chainalysis counted 46 publicly documented violent attacks on crypto holders in the first half of the year, with more than $30 million in losses and $107 million including attempted extractions. Home invasions rose to 37% of reported incidents, up from 26% in 2023.
Criminals resort to wrenches when the cryptography holds. The rise of physical coercion is, perversely, evidence that self-custody works — the seed phrase is hard enough to steal remotely that breaking down a door became competitive.
That equilibrium depends on remote attacks staying expensive. Cheapen them enough and the wrench stops being worth the risk, which is good news for individual safety and terrible news for everyone's balance.
The defenses that hold are the ones that do not require anyone to react
If attack speed collapses, human response time stops being a viable control. No security team detects, convenes, decides, and executes faster than automated extraction. Multisig approval flows measured in hours are decorative against an adversary measured in seconds.
What survives are constraints that bind before anything happens. Rate limits enforced in the contract. Withdrawal caps that cannot be raised without a delay. Circuit breakers that trip on invariant violations rather than on someone noticing. Timelocks on anything that changes permissions.
Vesting and liquidity locks belong in that category too, which is an underrated point about launch infrastructure — a token allocation held in an immutable contract through a service like Team Finance cannot be drained by an attacker who compromises a founder's laptop at three in the morning, because there is no key that shortens the schedule. The protection comes from the absence of an override, not from anyone being awake.
That principle generalizes badly for user experience and beautifully for security. Every discretionary control is an attack surface. Every irreversible constraint is one fewer thing an agent can talk its way past.
The honest counterargument
Maybe none of this happens on the timeline the panelists implied.
Automated vulnerability discovery has been "two years away" for most of a decade. Formal verification tools find real bugs but drown in false positives. Language models are good at recognizing known vulnerability patterns and unreliable at the novel economic reasoning that produces the expensive exploits — the oracle manipulations, the governance attacks, the multi-protocol interactions that require understanding what a system is for, not just what it does.
It is entirely possible that agents flood the low end, get commoditized by defensive agents doing the same scan, and the equilibrium reestablishes itself with more noise and roughly the same losses.
I would not bet the treasury on it. But the case is real, and anyone selling AI-driven security tooling has an obvious incentive to skip past it.
Assume the scan already ran
The useful posture is not fear. It is arithmetic.
Ask what your protocol looks like to an adversary for whom analyzing it costs almost nothing. If the only thing standing between your users and a drained contract is that nobody has bothered to look, that is not a security property. It is a queue position, and the queue is about to get a lot shorter.
The protocols that make it through the next two years will be the ones that stopped asking whether their code has been audited and started asking what happens on the day it is read by something that never gets tired, never gets bored, and has already read everything else.