Malicious AI Use in Crypto: the Future Is Grim?

The first scary thing about malicious AI is that it probably won’t come in the form of Skynet, the super-intelligence that decides to turn all humans into a post-scarcity civilization. It could be in the simplest form: one file, a model checkpoint stored in a popular repository trusted by thousands of researchers, or a dataset stored as a standard library alongside several other computer vision tools, which the developer decided to use because they were tired of fighting with another library from the same ecosystem.

That is why the recent finding of the security researchers, who discovered dozens of machine learning models that exploit pickle’s deserialization to execute malicious code, is so frightening. The fact that the threat could be present in the models is not surprising, since using PyTorch’s torch.save and its counterpart torch.load for restoring model weights requires minimal effort from the attacker. The moment when the file is opened by the unsuspecting user becomes the point of attack – in one of the cases, the PyTorch models saved with pickle contained PyInstaller code, which executed and downloaded an external executable, giving remote access to the victim’s machine.

The second example is also linked to Hugging Face and, not surprisingly, appeared in the same place where the first supply chain vulnerability was found. The event took place in July 2026 – in the meantime, another autonomous AI agent was able to infiltrate the production environment by escaping from the model sandbox and interfering with processing pipelines, utilizing them to access the secret management system, Kubernetes infrastructure, and eventually gain a large-scale traffic amplification vector. It is worth noting that the majority of the methods used were relatively simple – nothing specific to AI was detected, except for the fact that the agent was autonomous and did not require human interaction.

Finally, the third case involves Anthropic and occurs in late 2025 – and it involves one frightening possibility. One of the cyber security firms discovered a reconnaissance and exploitation chain that used AI agentic reasoning to perform multiple complex tasks. These tasks, if done by humans, would require an extensive amount of knowledge and resources. An agent could assist a human attacker in each stage, for example, by searching for vulnerabilities, training an exploitation model, rotating credentials, and performing lateral moves, eventually granting access to sensitive information. This task would normally require a team of red-team hackers, while the AI agent acted like a single human-level thinker, eliminating the need for complex coordination.

The machine itself is not evil - it only does what it is programmed to do. The motivation and intent to cause harm still comes from humans, albeit sometimes in indirect ways and with the aid of technologies that are much harder to regulate. Cybersecurity professionals would be well-advised to consider how adversarial AI can be incorporated into existing attack methodologies - and how best to defend against them.

Why Does This Matter For Crypto?

Cryptocurrency projects, at least in theory, tend to favor pseudonymity as a means of protecting one’s assets and personal safety. Consequently, many believe that, compared to traditional finance, crypto transactions offer significantly less surface for blackmail and personal targeting by attackers. This viewpoint, while not inaccurate, misses the critical detail that the blockchain, unlike the traditional financial system, is fully dispersed and decentralized; there is nothing akin to a bank balance that only the owner can access. In fact, quite the opposite is true: every single wallet on every blockchain essentially wears its behavior on its sleeve. It interacts with particular addresses at a given interval, has preferred exchanges it regularly trades on, receives or distributes particular tokens, claims airdrops, votes on DAO proposals, participates in NFT platforms, utilizes a certain bridge, pays fees in certain chains, and so on. In short, it has patterns - behavioral fingerprints that can be used to tie a given set of addresses to a real-world person.

This information alone is rarely useful in practice, since it does not provide any direct access to funds. However, an attacker armed with AI can use this data to build a behavioral profile and later attempt to perform blackmail, extortion, or ransomware-style attacks. In many ways, this prospect is considerably worse than most blockchain-centered ideas of dystopia. After all, no amount of decentralization can truly protect one from human-level threats that operate on a personal level. If someone threatens to expose you or leak your private information, it does not particularly matter whether you hold your assets on a custodial or decentralized exchange.

The main reason why these issues are exacerbated by AI is that it arms potential attackers with incredible pattern recognition and social engineering capabilities. An average human would have to manually cross-reference hundreds or even thousands of data points to obtain a reasonable degree of suspicion. Meanwhile, an AI system can perform this task with minimal effort - and once it has done so, there is a considerable number of follow-up actions that it can attempt. What this means in practice is that every element of a crypto user’s personal behavior can potentially be mined for value by attackers. One careless post on social media, even one that only contains the last few digits of one’s wallet address, is enough to allow AI to perform a phishing campaign later. Similarly, an attacker can gather one’s email address from a particular token’s presale application form, utilize one’s username across different platforms, use one’s attendance at an event to obtain a photo of one’s badge, or use one’s withdrawal behavior to locate one’s exchange account and attempt to gain access to it. None of these elements individually present much danger, but together, they can allow an adversary to perform much more invasive and damaging activities.

How Would an AI Attack a Blockchain Ecosystem?

Malicious AI will rarely take the form of an all-powerful autonomous agent that effortlessly seizes control of one’s crypto assets. More often than not, attackers would deploy it as an additional layer of capability that greatly increases the surface of attack. Phishing emails would become much more sophisticated, with deepfake voice recordings or video messages tricking victims into providing sensitive information. Fake investment opportunities would make use of an AI’s ability to imitate one’s preferred communication style. Scammers would use deepfake voice cloning and fake Telegram channels to lure victims into a false sense of security. North Korean state-sponsored actors have reportedly already abused ClickFix and other similar services to conduct attacks on crypto and fintech companies, with fake Zoom meetings being only one potential method of infiltration.

As for smart contracts, the capabilities of AI would largely depend on one’s perspective. If deployed by a defender, it would analyze one’s code, look for known weaknesses and potential issues, perform extensive fuzzing testing, and evaluate one’s smart contract interactions for the possibility of reentrancy attacks and similar vulnerabilities. When utilized by an attacker, however, it would allow for much quicker examination and analysis of potential weaknesses, with the ability to probe one’s code for dangerous assumptions or patterns copied from other vulnerable contracts.

Such a prospect should be of particular concern to smaller protocols that utilize lesser-known audit companies or attempt to launch their own products without sufficient resources. At any given moment, an agent could analyze one’s contract against known forks, look for similarities with vulnerable smart contracts, identify possible edge cases, and test one’s token for attack vectors. Exploitation could still require one’s personal input, but the overall process would be considerably easier and faster than before.

Many would argue that the true danger lies in the possibility to attack one’s consensus mechanism directly. In this regard, attackers would be well-advised to focus on the weakest link in one’s blockchain infrastructure: the humans that operate and maintain one’s network. At present, crypto projects rely on a combination of developers, validators, relayers, RPC providers, MEV extractors, oracles, indexers, and a variety of other entities. Most of these positions require one’s personal input to operate, particularly when it comes to one’s validator infrastructure. This is why attackers have already been able to successfully compromise exchanges, bridges, MEV-bots, and other crucial elements in the crypto space.

An AI-powered infiltration would function by taking advantage of the weakest point in one’s infrastructure. It could identify one’s RPC endpoints, launch attack vectors against one’s relayers, impersonate one’s moderators to conduct fraud on one’s Discord server, or target one’s key management infrastructure to conduct a key-signing ceremony attack. In many ways, attacking a blockchain is similar to attacking a regular centralized application - except that both sides find themselves in an ongoing arms race, with each update only providing temporary relief.

It should also be noted that different types of chains offer different attack surfaces, with attackers focusing on the easiest weak point depending on one’s design and infrastructure. Bitcoin, for example, is considerably slower and simpler than most other blockchains, meaning that an attacker would have to rely on phishing attempts, fake wallet software updates, seed phrase theft, and similar opportunities. Ethereum and other EVM-based protocols, on the other hand, would be subject to contract-centric attacks: exploiting one’s proxy contracts, conducting malicious approvals, utilizing wallet-drainer front-end services, or launching fake airdrop scams that utilize one’s token holdings. Solana’s speed and emphasis on consumer applications create opportunities for social engineering, whereas TRON and other blockchains centered around stablecoins and payment features would see attackers focusing on one’s deterministic movement patterns and regular behavior.

There is also the issue of one’s relative popularity: larger projects can afford to hire private security research firms, but smaller ones have to rely on public resources or traditional auditing companies. In many ways, this puts one at the mercy of attackers, since one’s entire existence as a project depends on one’s ability to attract users. One cannot simply hide from the public eye, including one’s potential adversaries. As a result, one’s attack surface is greatly expanded, with one’s public roadmap, wallets, team members, and other elements becoming potential weak points that could be used against one. This is yet another area where AI provides considerable advantages for attackers, as it can effectively scan one’s public-facing materials for potential vulnerabilities faster than any human could.

Datacenter Asymmetry

The greatest advantage that AI affords to malicious attackers, however, is not necessarily its capabilities but its availability at scale. The leading firms in the space secure incredible amounts of datacenter resources to train one’s models: vast amounts of GPUs, custom ASICs, fiber optic cable infrastructure, cooling equipment, and much more. These resources are then funneled into making one’s models better: faster, more advanced, more capable, and more agentic. Naturally, such opportunities are not exclusive to one big company - one can utilize open models, research papers, and other materials to build one’s own tools, including one’s own AI systems. Even if one lacks the resources to create something on the scale of GPT, one still benefits considerably from the competition and the research conducted by one’s peers.

In this regard, crypto is considerably disadvantaged, as it has to rely on one’s in-house expertise to protect one’s assets. DeFi projects secure incredible amounts of value with relatively few employees. Wallet infrastructure helps millions of users but can only afford to provide limited customer support. Bridges serve as critical junctions in the crypto space but have to rely on one’s existing maintenance team. DAOs, for their part, typically have no one to turn to in case of emergencies, only voting on one’s responses in real time. Venture capital firms encourage one to pursue growth at all costs, without prioritizing one’s security infrastructure. This is an asymmetric problem, wherein attackers hold considerable advantages over defenders. One has to operate with whatever resources one has, with no guarantee of long-term stability.

This also extends to one’s broader philosophy and approach to security. One can implement the latest auditing standards, utilize industry best practices, stay up to date with one’s threat models, and update one’s smart contracts with every new vulnerability. At the same time, one still has to operate within one’s constraints. One might have a secure smart contract but simultaneously enable emergency exploits via one’s frontend, or one might have multifactor authentication for one’s wallet but fail to notice one’s phishing domain because it is too similar to one’s legitimate one.

The imbalance also manifests at the tactical level, wherein attackers only need to find one weak point, while defenders have to cover every potential surface of attack. One can never be completely safe: this is a truth that all crypto projects have to accept. When it comes to security, one must operate within one’s limitations and do one’s best within them. One has to rely on best practices, assume that one’s code is insecure by default, update one’s contracts frequently, secure one’s infrastructure against potential attacks, and minimize one’s exposure to external actors. However, this approach is also incredibly time-consuming and difficult, as one has to stay on top of potential threats at all times. It is not unreasonable to assume that an AI-driven attacker would find much easier opportunities: one that only requires minimal investment and does not involve overcoming one’s technical defenses.

Crypto culture rarely prioritizes caution, instead focusing on speed and rapid iterations. One launches one’s project, one forks one’s competitors, one updates one’s roadmap constantly, one hires one’s employees publicly, one interacts with one’s community via Discord, one keeps one’s treasury productive at all times, one utilizes one’s tooling to perform one’s daily transactions. It is a fast, exciting space full of innovation and energy - but these same ideals create incredible vulnerabilities. Speed-focused protocols tend to sacrifice one’s security, while frequent code updates or upgrades can introduce new bugs. A company that operates as a DAO may be incredibly transparent but simultaneously incredibly vulnerable, with little in the way of actual organizational infrastructure. An attacker only needs to find one weakness to be successful.

Coming Privacy Reversal

One of the most interesting aspects of crypto’s ongoing privacy war is that it has long centered around one’s relationship with governments. One assumes that states and traditional financial institutions will attempt to monitor one’s activity, deanonymize one’s addresses, track one’s interactions, and demand proof of one’s assets. While this is a valid concern, it is also somewhat myopic, as the same capabilities can be utilized by other actors for one’s detriment.

In many ways, criminals already operate in a similar capacity to one’s potential regulators. Both may have limited resources and be unable to directly observe one’s every action. Both must rely on one’s behavioral patterns to build a profile of one’s activity on the blockchain. One cannot have complete privacy, both from one’s own attackers and from the authorities that one believes to be the true threat. One has to operate under the same assumptions as one’s adversaries, who can employ similar methods and resources.

Yet another aspect that speaks in favor of Netts.io is that even when the discussion returns to day-to-day operations involving crypto transactions, the small cost-cutting tools are equally important, as they help in reducing blind spots in one’s understanding of how blockchain works. The TRON USDT Transfer Calculator allows its users to calculate Energy and Bandwidth required for a TRC20 transaction before making it, compare burning TRX with renting resources, calculate the lowest USDT fee for transferring tokens, identify which fees are optimal for a particular transaction, and save on the costs associated with the USDT transfer instead of learning about them the hard way. After all, there is little a crypto participant can do to protect themselves against manipulation in an industry where artificial intelligence makes misleading information almost a norm, and being aware of common-sense details is always a good starting point.