TL;DR

AI has already moved from optional tooling to core attacker infrastructure. CrowdStrike says AI-enabled adversaries increased operations by 89% year over year, while average eCrime breakout time fell to 29 minutes in 2025. In a sector where public code can guard a nine-figure value, that is a material shift in attacker speed.
On the white-hat side, machine learning is already useful in two places that matter: contract analysis before deployment and anomaly detection after deployment. Recent smart-contract research and production systems show ML helping with code classification, business-logic discovery, exploit pattern recognition, and live transaction screening.
Attackers get the same leverage. Microsoft reports much stronger click-through from AI-automated phishing, Chainalysis documents AI-powered deepfakes, voice cloning, phishing bots, and support impersonation in crypto, and Anthropic has already published a case where AI handled most of a real intrusion workflow.
The right response is not replacing auditors with models. It is combining AI-assisted review, runtime monitoring, tightly scoped emergency controls, and human judgement. Even the most prominent smart-contract benchmark still shows incomplete coverage, and OpenZeppelin has warned that benchmark contamination and flawed ground truth can overstate model capability.

The Arms Race is Already Here

There is a comforting story that AI in Web3 security is still experimental. That story is already obsolete. The wider cyber landscape has moved first, and crypto inherits every part of that shift. CrowdStrike’s 2026 threat reporting frames AI as an operational accelerant for reconnaissance, credential theft, and evasion, not as a future scenario. In parallel, the average breakout window is shrinking, which means teams have less time to understand what is happening before funds, keys, or privileged paths are abused.

Web3 is especially exposed because the environment is unusually machine-readable. Smart contracts are public, exploit history is heavily documented, and real value is concentrated in deterministic execution paths. That is exactly why OpenAI and Paradigm launched EVMbench: they explicitly argue that smart contracts are an economically meaningful environment for measuring whether AI agents can detect, patch, and exploit high-severity vulnerabilities. Their benchmark uses real vulnerabilities from audits and shows that frontier agents are improving quickly, especially on exploit tasks.

The broader financial impact is already visible.

Hacken says more than $4 billion was lost to Web3 incidents in 2025 and notes that AI-native security failures now deserve their own section in annual security reporting. On the fraud side, Chainalysis estimates that crypto scams and fraud reached a record $17 billion in 2025 as impersonation tactics and AI enablement surged.

The debate, then, is no longer whether AI belongs in Web3 security. The real question is which side operationalises it faster.

Where AI Genuinely Helps Defenders

Contract triage and vulnerability surfacing. Recent review work shows smart-contract security research using a widening mix of CNNs, RNNs, GNNs, and hybrid models. A 2025 study using software metrics and topic modelling found strong predictive signals in properties such as cyclomatic complexity, nesting depth, and function-call structure, with strong classification results on Solidity contracts. That matters because a good model can prioritise suspicious modules before a human auditor spends hours in the wrong file.
Business-logic analysis, where many real losses live. Syntax-level issues are the easy part. Functional bugs, broken invariants, and exploitable business logic are harder. The PromFuzz research is useful here because it does not treat the contract as raw text. It uses an auditor-agent and attacker-agent pairing to extract hidden business logic, generate invariant checkers, and guide fuzzing toward meaningful states. That is much closer to how real DeFi failures happen.
Runtime anomaly detection for novel threats. Forta makes the distinction clearly in its docs: supervised classification works for attacks that resemble previous incidents, while anomaly detection matters when behaviour drifts away from learned normal patterns. Forta’s production network monitors on-chain activity in real time through thousands of detection bots, and its public starter kits include ML detectors using Isolation Forest models to flag anomalous token-transfer activity and catch several known exploit transactions.
Fraud and cross-channel intelligence. On-chain data alone is rarely enough. Hexagate, now part of Chainalysis, describes a stack that mixes threat intelligence, behavioural analytics, and machine learning to identify high-risk transactions and execution paths in real time. Chainalysis’s Alterya product pushes this even further by connecting scam signals across web, social, chat, and blockchain activity so fraud can be blocked before funds move.

How attackers weaponise the same tools

Reconnaissance at machine speed. CrowdStrike says attackers are already using AI across reconnaissance, credential theft, and evasion. Anthropic’s public case study goes further: its investigators say a threat actor used Claude Code to inspect target systems, identify high-value databases, research and write exploit code, harvest credentials, create backdoors, and exfiltrate data, with AI handling 80 to 90 percent of the campaign workflow.
Phishing that no longer looks like phishing. Microsoft’s 2025 Digital Defense Report says AI-automated phishing emails achieved 54% click-through rates, versus 12% for standard attempts. In crypto, Chainalysis lists deepfakes, phishing bots, fake trading platforms, chatbot impersonation, AI-powered support scams, and voice cloning as active fraud formats. This matters because many crypto losses still begin with approvals, recovery phrases, or privileged credentials, not with exotic bytecode wizardry.
Scam operations with better economics. Chainalysis says AI-enabled scams cluster in its high-value, high-volume quadrant and, on average, extract $3.2 million per operation versus $719,000 for scams without visible on-chain links to AI vendors. That 4.5x revenue gap is the kind of performance improvement that industrialises fraud fast.
Adaptive offensive tooling. Mandiant, via Google Cloud, says attackers have moved beyond casual productivity gains. By the end of 2025, some were integrating LLMs directly into malware, while frontline reporting now discusses AI-orchestrated espionage and adaptive code obfuscation. In Web3 terms, that means faster exploit iteration, faster lure generation, and faster operator decision cycles around live opportunities.

What machine-speed defence actually looks like

Point-in-time auditing still matters. It always will. But point-in-time auditing alone is a weak answer to machine-speed offence. The defensive edge comes when AI is wired into runtime controls. Forta’s own materials describe a stack built around real-time monitoring, simulation, anomaly detection, and pre-chain prevention.

Forta Firewall says it blocks malicious transactions before execution, while Forta’s public figures claim more than 99% recall with extremely low false-positive rates.

Chainalysis makes a parallel case through Hexagate, which continuously evaluates protocol state and on-chain activity to identify risky execution paths and trigger action in real time.

A practical pattern looks like this:

uint256 public threshold = 80;

bool public paused;

function submitRiskScore(uint256 score) external onlyRole(MONITOR_ROLE) {

if (score >= threshold) paused = true;

modifier live() { require(!paused, “paused”); _; }

function withdraw(uint256 amt) external live { _withdraw(amt); }

The point is straightforward. Let the model score abnormal behaviour off-chain, then connect that score to a bounded on-chain response. Do not hand unrestricted admin powers to an AI system. Hand a narrowly scoped monitor role to a trusted component, keep privileges granular, and put broader administrative changes behind delay and review.

OpenZeppelin’s access-control guidance makes the security logic clear: critical functions should be tightly permissioned, least privilege is good practice, and delayed operations help reduce damage from bad admin decisions or compromised operators.

Where the Hype Still Breaks

AI helps. AI also lies. That distinction matters more in Web3 than in many other domains because false confidence can become a treasury event. OpenAI’s EVMbench is useful precisely because it tries to measure real capabilities across detection, patching, and exploitation in realistic smart-contract environments. It also shows that even strong agents are far from full coverage, especially outside exploit tasks. Paradigm is likely right that agents will take on a growing share of future audits. But that is different from saying they are ready to replace expert security review.

OpenZeppelin’s review of EVMbench is an important correction to the current mood. Its researchers argue that benchmark contamination can blur the line between memory and discovery, and they say several supposedly high-severity benchmark findings are not actually exploitable. If that critique holds, then some leaderboard gains may reflect alignment with noisy training data rather than robust vulnerability discovery. That is the exact failure mode security teams should fear: a tool that looks brilliant in demos but floods real workflows with false positives, shaky exploitability claims, or stale patterns.

The stronger version of AI in Web3 security is narrower and more useful. Use it to rank risk, compress search space, generate candidate invariants, identify behavioural drift, and accelerate repetitive review. Constrain it with audited libraries and current security patterns, which is the logic behind OpenZeppelin’s Contracts MCP and Skills projects. Let humans own exploitability decisions, threat modelling, economic assumptions, and final sign-off. That is not anti-AI. It is how mature teams stop hype from becoming an attack surface.

How Exploitless Fits into this Picture

At Exploitless, this is the frame we care about: AI should expand coverage, shorten detection time, and sharpen monitoring, but serious Web3 security still depends on adversarial thinking, explicit invariants, and disciplined review. The company’s own positioning is clear on that point. Exploitless describes itself as a fully independent smart-contract auditing and Web3 security firm built around deep, adversarial audits, direct access to engineers, and dual independent review passes. Its stated mission is to ensure stakeholders in blockchain innovation can use Web3 securely.

That makes AI a force multiplier, not a substitute. If you are building a protocol where one missed assumption can become a public exploit, the right question is not whether to choose AI or auditors. The right question is whether your security programme lets AI do what it is good at, while humans stay responsible for the decisions that actually move risk.

Learn more at Exploitless

References

Chain Analysis: AI-Powered Crypto Scams: How Artificial Intelligence is Being Used for Fraud
CrowdStrike: 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface
Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign
Hacken: Learn About the State of Blockchain Security in 2025 Hacken Yearly Report

AI vs. Web3 Security: Machine Learning on Both Sides