How Mythos and other AI models help hackers steal cryptocurrency

AI has uncovered numerous security vulnerabilities in computer systems around the world. Central bank governors and major banks are sounding the alarm. Decentralized finance is also adapting to this new AI-driven reality

Representatives from traditional and global central banks have identified a threat in the new capabilities of artificial intelligence (AI) that can identify vulnerabilities in computer systems. This came amid testing of Claude Mythos Preview—an experimental AI tool from Anthropic that has already demonstrated the ability to find numerous critical vulnerabilities in all major operating systems and browsers. This is forcing the crypto market to rethink all security systems right now to avoid becoming a target for neural networks.

Just as Mythos entered public discourse, the crypto market faced a series of hacks exploiting infrastructure vulnerabilities. As it turned out, security “holes” in blockchain solutions lie not so much in the smart contract code as in the infrastructure that supports them—access key management systems, price oracles, and cross-chain bridges—which traditional audits rarely take into account when assessing risk.

The first alarming comments about threats from new AI models came not from the crypto market, but from traditional finance. Andrew Bailey, Governor of the Bank of England and Chair of the Financial Stability Board (FSB), called the situation a “very serious challenge” and emphasized that regulators would need to urgently assess the cyber risks to the global financial system. He was supported by European Central Bank (ECB) President Christine Lagarde. She described Mythos as an example of a development that, if it fell “into the wrong hands,” could have catastrophic consequences.

Executives at JPMorgan, Morgan Stanley, BNY, and Citigroup also confirmed that, while working with the beta version of Mythos, they are identifying “a host of vulnerabilities that need to be fixed.” At the same time, however, they are exploring the potential benefits in terms of improving infrastructure efficiency and cybersecurity.

In April alone, attackers caused at least $570 million in damage to the crypto market by exploiting vulnerabilities in cross-chain bridges and sophisticated social engineering schemes. The total losses accumulated since the beginning of the year amount to approximately $800 million. The most significant incident in terms of its impact on the industry was the $290 million hack of the Kelp DAO cross-chain bridge. The situation caused problems not only for Kelp’s clients but also for users of the largest lending protocol, Aave, as well as for dozens of other protocols in the crypto market, which suspended or restricted their operations.

Thus, decentralized finance (DeFi) simultaneously experienced both the consequences of systemic issues in the sector and a wave of concerns regarding the capabilities of AI. And some researchers attribute the sharp increase in the number of successful attacks to the emergence of powerful neural networks, particularly Mythos.

A New Reality for DeFi

Traditional banks can quickly “patch” vulnerabilities identified by AI, but DeFi protocols find themselves in a more vulnerable position. Their architecture is designed to be open and immutable. And if AI discovers a critical flaw in a smart contract, it cannot be fixed instantly. In such cases, it is rarely possible to coordinate everything within hours; more often than not, the process takes days.

From a security standpoint, what’s even worse is that DeFi projects operate on largely similar infrastructure mechanisms, and if these fail, several interconnected solutions could be affected at once.

“Composability is what makes DeFi capital-efficient and innovative. But it also means that a minor vulnerability in one protocol can become a critical vector for potentially infecting the entire ecosystem,” said Paul Wigender, head of security at Gauntlet, which manages risks for Aave.

Wigender added that, when considering AI threats to crypto projects, he is more concerned about the “human and infrastructure” layer of security. And his words point precisely to the two major vulnerabilities in April, which collectively cost more than $570 million in less than a month.

Aave founder Stani Kulechev noted that it is no surprise that attackers are using AI, as “it is simply an evolution of the tools they use,” exploiting old bugs that were previously irrelevant. But Kulechov also pointed out that these same tools will give developers the opportunity to conduct better and more rigorous stress tests for their projects.

The founder of Aave was echoed by Hayden Adams, founder of the largest decentralized exchange, Uniswap. He noted that projects that do not use these new tools will today “find themselves in the highest-risk zone.”

*Trade $OKB on OKX, special bonuses from us: https://okx.com/join/w3lab