The Real Reason Behind Most DeFi Hacks

April saw nearly as many DeFi hacks as days in the month, with about $635 million lost. The speaker cautioned that identifying who carried out an attack is difficult: postmortems may offer few clues, and sophisticated attackers can erase traces. Their network had seen intensified North Korean activity, but the speaker doubted that it explained all the incidents. The broader lesson was that the visible scale of the losses does not necessarily make their causes or perpetrators clear.

Most crypto security incidents, the speaker said, still come from familiar failures: stolen keys, unauthorized access to machines, or code running where it should not. AI may help attackers discover and exploit existing vulnerabilities faster, but it does not create the underlying bugs. Logs often cannot establish whether AI was used in an attack. The speakers argued that organizations should use AI defensively alongside conventional security measures, including continuous red-teaming and fixing weaknesses.

Matt said defenders have an advantage because they understand their own environments and have greater visibility into them. Security, development, and IT teams should use AI to strengthen their capabilities rather than treat it as an attacker-only tool. In the DeFi incidents examined most closely over the prior 30 days, the speaker thought greater decentralization might have mitigated many of the attacks. Unexpected centralization can create single points of failure, so responses should consider adding parties and distributing control.

The speaker’s impression was that social engineering contributes substantially to many attacks, although complete postmortems are often unavailable. By impact, nearly all major DeFi hacks likely involve social engineering somewhere in the attack flow, often as a way to compromise keys; attacks without it tend to be smaller. Social engineering can give an attacker an initial foothold that enables exploitation of other weaknesses, making it a potential link between human error and technical compromise.

Multiple people, signatures, time delays, and multi-party authorization can make an attack harder and reduce dependence on any one person. Matt recommended that people with access to sensitive assets map out what an attacker could do if they were compromised, then tighten controls and restrict access. AI can help assess whether those attack scenarios are feasible without executing them. Other core defenses include distinct passwords, fine-grained permissions, restricted production access, avoiding unilateral control of key systems, and addressing supply-chain risks.

The speaker also recommended passkeys for stronger anti-phishing protection and advised treating unexpected emails, links, requests for information or money, and software installs as possible attacks. Crypto’s public transparency makes hacks and losses more visible than corporate incidents, where damage may be harder to quantify or companies may have reasons to conceal it. DeFi has faced pressure to improve security since its beginnings, and the speaker said that in its ideal form, it can be more secure.