Manuel Aráoz, co-founder of OpenZeppelin — the security firm that audited Aave, Compound, MakerDAO, Uniswap and Coinbase — posted a blunt warning this week: all DeFi is unsafe. He said he personally told his friends and family to exit every DeFi position they hold. The message, coming from the person who built DeFi's top security firewall, landed hard.
AI Agents Shift the Offensive Edge
Aráoz pointed to two reasons on X. First, AI coding agents now have superhuman capability in finding smart contract vulnerabilities. Second, the security game is deeply asymmetric: attackers need one hole, defenders must seal every single one. That asymmetry has always existed, but AI changes the scale entirely. An AI agent never tires; it scans thousands of contracts simultaneously and catches edge cases a human auditor would miss after a long shift. A purpose-built AI security agent now detects vulnerabilities in 92% of exploited DeFi contracts tested, covering $96.8 million in exploit value across 90 real-world cases — far surpassing human-only detection rates.
The same tools defenders use to find bugs can be weaponized by attackers. Prior research from Anthropic and OpenAI shows AI agents can execute end-to-end smart contract exploits at low cost, confirming offensive AI is scaling faster than defensive adoption. The tools built to protect DeFi are now being turned against it.
$840 Million Lost in Five Months
Frontier AI agents now execute full exploits on 72% of known vulnerable contracts, according to Cecuro security researchers. Losses are stacking up at a historic pace: over $840 million lost to DeFi hacks in the first five months of 2026, with April alone accounting for more than $600 million. The largest attacks: $292 million KelpDAO exploit and $285 million Drift Protocol breach. TRM Labs reports that North Korea-linked actors accounted for 76% of global crypto hack losses through April 2026, up from 64% in 2025 and under 10% in 2020. These are not amateurs; they are well-funded, AI-assisted teams operating with professional precision.
DefiLlama's cumulative tracker puts total crypto hack losses over the past decade at $17 billion across more than 500 hacks. TRM Labs' 2026 Crypto Crime Report confirms 2025 losses hit $2.87 billion, with the Bybit compromise alone at $1.46 billion. On a per-month basis, 2026 is pacing worse. Aráoz's asymmetry argument is visible in every number: audits cost money and time, cover only the code that exists today, not the version an attacker manipulates tomorrow. Researchers believe $3.8 billion in exploit losses across 2024 and 2025 could have been prevented with better tooling.
Industry Response: The 'Audit and Ship' Era Is Over
Aráoz's warning is a structural alert, not a call to abandon crypto. The threat model has changed: AI has shifted the offensive edge to attackers in a way traditional audits cannot keep pace with. OpenZeppelin launched Skills, a system giving AI coding agents authoritative knowledge of audited smart contract libraries to prevent insecure patterns at the point of development. Defense is shifting earlier into the pipeline, but it is not yet a complete answer. Analysts say DeFi's survival depends on three changes: real-time on-chain monitoring with auto-pause capability, formal verification at scale, and governance systems that can respond to exploits in minutes rather than hours. Until those become standard, users face a market that is unsafe by architecture — not by accident.