The Real Reason Behind Most DeFi Hacks

Most DeFi hacks in the period discussed involved conventional security failures, specifically stolen keys, unauthorized machine access, and code executed in unintended locations. Social engineering appears somewhere in the attack flow of nearly all significant incidents, typically as the method used to compromise a key or set of keys. Hacks that do not involve social engineering do occur but tend to be small and low-impact.

Approximately 635 million dollars was lost to DeFi hacks in April, with nearly as many incidents as days in the month. Gleason attributes the spike partly to increased attacker capabilities tied to AI models hosted in or released by China, partly to geopolitical tensions prompting more brazen retaliatory cyber activity, and partly to what his network believes is an intensification of North Korean activity, though he stops short of attributing all April attacks to North Korea. Post-mortem analyses often cannot identify attacker identity because sophisticated attackers clean up their tracks, and an AI-assisted attack leaves no forensic signature distinguishable from a human attack.

Lazarin argues that the underlying bugs exploited in these hacks existed before any AI found them, making the question of whether AI was used largely irrelevant to the root cause. His core claim is that attackers may have adopted AI faster than defenders, and that this asymmetry, not AI capability in general, is the actual risk. His recommendation is to massively increase use of AI to red team and attack their own systems using every available tool and security expert.

Defenders have a structural advantage over attackers because they have greater visibility into their own environments and face no penalty for discovering their own vulnerabilities during testing. AI functions primarily as a visibility amplifier, allowing both sides to identify existing vulnerabilities faster and at greater scale, not as a categorically new weapon. Lazarin cites OpenAI's cyber-focused fine-tuned model and his own access at approximately 200 dollars per month as evidence that these tools are accessible to defenders at low cost.

Lazarin characterizes Anthropic's public messaging around AI risk as doomsday marketing, noting that Anthropic has publicly argued its own products could cause widespread devastation while the predicted classes of harms are not materializing, whereas cyber harms may be. He argues that restricting AI from bad actors is futile because determined attackers will eventually build or acquire the tools regardless of controls, and that the correct response is to arm defenders rather than attempt to limit attacker access.

Crypto faces a unique narrative disadvantage on security because losses are denominated in specific dollar amounts and recorded publicly on-chain, whereas traditional corporations have strong incentives to conceal hack damage, obscuring the true scale of non-crypto cybersecurity failures. Lazarin frames DeFi hacks not as a crypto-specific problem but as a visible instance of a broader and largely hidden cybersecurity crisis affecting all sectors.

The intensification of stakes in cybersecurity is driven more by the increasing connectivity of important systems to the internet than by AI itself, with AI representing a further intensification of an existing dynamic. Security recommendations have not changed fundamentally and still center on unique passwords, fine-grained permissioning to prevent unilateral access to key systems, and mitigation of supply chain attacks. Decentralizing control makes social engineering harder to execute because compromising multiple people and then defeating multi-signature requirements and time delays compounds the difficulty for attackers.

A security meme circulating for roughly 20 years holds that social engineering has no patch because there is no patch for human stupidity. One speaker argues that AI guarding humans is the eventual patch, on the basis that AI systems can be stress-tested against hundreds of thousands or millions of attack scenarios, making it possible to measure their resistance to social engineering more rigorously than is possible with human beings. The speaker predicts that combining AI models with cryptography will likely become more secure than relying on humans to protect certain systems, while acknowledging this prediction is fuzzy and not fully formed.

Phishing campaigns are deliberately engineered to induce panic, and pausing to consult an AI before acting is recommended as a way to break that panic cycle. One speaker described pasting a suspicious email into Codex, which validated the DKIM signature, wrote a CLI program to do so, checked the age of the sender domain, discovered a recent domain change with a redirect on the old domain, and researched the sender, all in a single session. Passkeys are recommended over typed passwords because they use cryptography by design and are structurally more resistant to phishing. Specific high-risk behaviors named include sharing passwords or private keys, clicking unsolicited links, visiting URLs sent via text message, and installing software under time pressure.

The recommended internal red-team exercise involves having employees with access to sensitive systems identify what damage they could personally cause if their own devices were compromised, then using those findings to implement better access controls, restrictions, and multi-party authorization. Asking an AI to assess the feasibility of specific attack vectors is presented as a practical substitute for running full exploits during internal security reviews.