🔍 AI Agents vs Smart Contracts

April was one of the worst month In the history of crypto hacks. AI is not the fire starter, but it is learning to control the flame.

These are not normal numbers to close out April.

However, in a single month, April 2026 alone, $629.69 million was stolen from crypto protocols, the highest single-month total for any month on record according to data compiled by DefiLlama. There were 28 and up to 30 separate incidents, nearly one attack for each day.

The amount lost in April alone was more than 3.7 times the sum of all losses in the entire first quarter, although that still only amounted to a total loss of $165 million across 35 incidents. Four months in, the industry has now seen more than $1 billion stolen this year alone.

Three attacks made for 93% of the damage done. April 1st: $285 million loss to Drift Protocol. On April 18, KelpDAO suffered a loss of $293 million. Both have been covered extensively in this newsletter already. There, however, the story does not end, and it is in the tail of smaller incidents that something new, disturbing is emerging.

Why no one is talking about the AI hacking problem

GoPlus Security reported four separate Ethereum smart contract exploits in 48 hours ending April 29. Aggregate loss: $1.5 million between an onchain aggregator, a TradingProtocol vault, a BCB contract and a QNT asset contract The individual amounts are small. The pattern is not.

Reading the research behind that statement helps explain it, and why the firm called this moment a "countdown-by-the-second era."

a16z crypto ran a lab experiment: They presented an out-of-the-box AI coding agent with 20 archival examples of price manipulation on Ethereum and then challenged it to recreate the exploits. The AI managed to succeed 10% of the time, armed only with a contract address and some basic tools. When researchers fed it organized knowledge of common attack patterns (including vault donation exploits, AMM pool manipulation and oracle games), the hit rate predictably soared to 70%.

That number should land heavily. When the AI can gain the ability to find the steps of an autonomous exploit against patterns of known vulnerability is 70% successful, it means that AI becomes smart enough to not only dog-eared bug-finding tool.

This is starting to become a weapon being able to scale up attacks at speed faster than what any human team can deal with. In fact, one of the a16z agents even tried to break out of its own sandbox by retrieving a key for future block data. Something was hoping to gain an advantage that the researchers never considered.

The most explicit public statement of where this is headed comes from Anthropic itself, and its recent disclosure around Mythos Preview. Earlier models had an enormously average zero percent success rate at writing successful exploits, before the advent of Mythos. Mythos changed that baseline.

The very qualities that make the model so good at patching vulnerabilities also make it so good at finding and exploiting them. This is exactly why Anthropic didn't released it publicly. However, the capability curve itself is not specific to Anthropic. All the big guns are on this trajectory.

The North Korea dimension

A story about AI isn't the only thing April's hack record checks this box. This is a tale of industrial-scale state-sponsored embezzlement.

TRM Labs identified 75% of all crypto losses in 2026 through April, $577 million out of total $759 million: as originating from hacking units backed by the North Korean government. North Korea has stolen $6 billion in crypto since 2017 The money is directly diverting into weapons programs and state operations the international sanctions are meant to cut.

Here is one description of the change from TRM Labs' global head, policy Ari Redbord: "We aren't watching a larger North Korean campaign that it. It is one that is sharper." Take the Drift hack, for example. Even worse, the hackers had spent six months befriending Drift team members before launching their attack. And when they did, $285M was drained within 12 minutes.

It is the blend of state-level waiting and AI-aided precision that makes the threat landscape today different from anything DeFi has seen before.

What that leaves the industry with

More than $14,000,000,000 of total value locked exited DeFi protocols within days after KelpDAO was published more specifically in bridge and lending platforms. Surprisingly, different is the attack surface that keep generating by far the biggest losses: it is not smart contract code, on which the industry has spent years knitting up its most costly problems through audits.

It is the infrastructure that connects blockchains: bridges, oracles, signing systems and multisig key holders. These are more difficult to audit, harder to keep track of and when they fail, fail as a whole across all chains fired on.

Defensively, almost inevitably, it too is AI. Protocols are evolving towards a monitoring system robotics ran by ai that flag unusual transaction patterns through transaction completion. The irony is not subtle. The tool that created this threat is also the best weapon against it.

As GoPlus Security bluntly states: DeFi Developers have nowhere to go but AI when it comes to resolving the issues created by AI.

That is the security context in which crypto starts the month of May. The month in which the most hacks occurred in all history just came to an end. The conditions that created it have not been altered.

Amazon Quick: AWS just launched this at their What's Next event this week. It is an always-on AI work assistant with a desktop app that connects to your local files, calendar, Google Workspace, Zoom, Slack, Airtable, Dropbox, and Microsoft Teams simultaneously. Free tier available, no AWS account required.

Oobit launches visa corporate cards for AI Agents

Backed by Tether, Oobit has launched Agent Cards. The first ever corporate spending and Visa card solution designed for software over humans. The card allows AI agents to directly spend USDT at 150 million merchants worldwide, avoiding the "human-in-the-loop" infrastructure needed to approve cloud costs and software vendor payouts.

Join the Conversation!

We'd love to hear your thoughts and comments. Join our community and stay updated with the latest trends and discussions in crypto.

Twitter | Instagram | Telegram Channel | Linkedin | Facebook