Why blockchain security structurally favors attackers

TL;DR

• DefiLlama recorded 152 public incidents and $1.066 billion in nominal losses from January 1 through July 27, 2026. The 108 non-zero-loss DeFi protocol incidents accounted for $959.5 million.
• The 20 largest protocol incidents accounted for $870.9 million—90.8% of protocol losses. Only seven had a publicly verifiable, ongoing paid bounty program before the incidents occurred.
• Infrastructure failures represented only 15.1% of incidents but caused 71.3% of losses, showing how much realized risk sits outside typical contract-focused coverage.
• AI can provide continuous security coverage across a protocol’s code, deployments, and transactions. But reversing the asymmetry also requires a shared response system that can act before vulnerabilities become incidents.

The asymmetry

Attackers have a structural advantage in blockchain security. They can continuously probe live systems, operate without scope constraints, and profit immediately when an exploit succeeds.

Defenders operate differently. Audits capture a system at one point in time. Many projects have no discoverable paid bounty, and existing programs can still fail through narrow scope, weak adjudication, or slow response.

Every pool of extractable onchain value is an implicit attacker bounty. The two sides operate under different rules:

Discovery

• Attacker: Live systems can be probed continuously, whether or not their source code is public.
• Defender: A researcher must first discover the project, affected asset, and reporting route.

Scope

• Attacker: Any path that extracts value qualifies.
• Defender: Contracts, dependencies, keys, and frontends may be excluded.

Adjudication

• Attacker: The transaction either succeeds or fails.
• Defender: A valid report can be disputed, downgraded, or treated as intended behavior.

Incentives

• Attacker: The value at risk is often observable, and the potential payoff is not constrained by a bounty cap.
• Defender: The reward may be capped, discretionary, delayed, or absent.

Response

• Attacker: Execution and payoff are immediate.
• Defender: Validation, pausing, remediation, and disclosure require several parties to act.

This advantage comes from three gaps: audits are snapshots, bounty coverage is incomplete, and even valid signals do not reliably lead to action.

1. Audits are snapshots

Audits, competitions, and manual reviews remain essential. But they evaluate a defined codebase and configuration, within a defined scope, at a particular moment. Production systems keep changing after that moment.

One recent analysis scanned approximately 653,000 commits across 5,583 crypto repositories. Its published dataset contains 2,851 security fixes judged likely to address bugs that had already reached production.

For 533 bugs, the analysis could determine whether each was introduced before or after the repository’s first release. Of those, 72% were introduced after launch—through an upgrade or feature commit rather than in the initial release. This is the snapshot problem in one number: most of the traced bugs appeared as the system changed, after its original version was already live.

For 661 fixes, the dataset traces both an introduction date and a fix date. The median bug remained live for 69 days; 89 remained live for at least one year, and 29 for more than two years.

Four fixes could be matched end to end with publicly documented exploits. In those cases, the vulnerable code had been live for 35 to 247 days before exploitation, yet three of the four were patched within two weeks after funds were lost. The vulnerabilities remained live for months; in three of the four cases, fixes shipped within two weeks of exploitation.

This does not establish that every affected protocol had been audited. It shows something more fundamental: security bugs can remain in production for months, while upgrades and feature changes can introduce new risks after an audit is complete.

The problem is not that audits fail. The problem is expecting a point-in-time review to protect a continuously changing system.

2. Bounty coverage is incomplete

Bug bounties extend security beyond a scheduled audit, but they do not create universal coverage.

The DefiLlama Hacks dataset contains 152 public incident records and $1.066 billion in nominal losses between January 1 and July 27, 2026. Of 111 records classified as DeFi Protocol, 108 non-zero-loss incidents account for $959.5 million.

The 20 largest protocol incidents accounted for $870.9 million, or 90.8% of protocol losses. Only seven had a publicly verifiable continuous paid bounty before the incident. Those seven still lost $381.7 million. No equivalent pre-incident mechanism was publicly verifiable for the other 13.

• Confirmed continuous paid public bounty: 7 incidents, $381.70 million in nominal losses.
• Possible mechanism, but timing or scope not established: 3 incidents, $353.40 million.
• Disclosure route, but no confirmed economic reward: 2 incidents, $13.50 million.
• Historical or one-off mechanism only: 2 incidents, $13.40 million.
• No public mechanism found: 6 incidents, $108.88 million.

Absence of public evidence does not rule out a private arrangement. But an undiscoverable route is unavailable to an outside researcher. And a bounty page does not guarantee continuous monitoring, adequate scope, reliable adjudication, or timely containment.

Scope is especially important. A study of DeFi bug-bounty programs found that 85.7% covered smart contracts, but only 21.3% covered user interfaces and 11.9% covered wallets; oracles and third-party dependencies were also frequently excluded.

Operational security is becoming a larger part of the realized attack surface. In H1 2026, wallet compromise caused $444.5 million in losses across just 33 incidents, making it the most financially destructive attack vector. Code vulnerabilities were far more frequent—204 incidents—but caused $151.6 million.

Coverage has not caught up. Even among protocols that volunteered for an independent security assessment, STRIDE found that only about 13% demonstrated mature operational-security practices, while only 17% had comprehensive logging and alerting.

The expanding attack surface includes keys, signing workflows, developer devices, deployment pipelines, and privileged access, areas that conventional smart-contract audits and most bounty programs were not designed to cover.

3. Signals still fail to become action

Coverage is only the first half of defense. A signal must reach the right owner, be evaluated in context, and trigger action before an attacker can exploit it.

Three 2026 incidents show different ways that conversion can fail.

ZetaChain: the report arrived, but the risk was misjudged

In late April, an attacker drained approximately $334,000 from ZetaChain-controlled wallets; no user funds were affected. The exploit chained unrestricted cross-chain calls, incomplete filtering of token-transfer functions, and unlimited token approvals into a path for moving protocol-controlled assets.

ZetaChain’s post-mortem acknowledged that the vulnerability class had previously been submitted through its bug-bounty program but treated as intended behavior. The reporting route worked. Adjudication did not.

KelpDAO and LayerZero: the risk was known, but the control was optional

On April 18, a forged LayerZero message released 116,500 rsETH—approximately $292 million—without a corresponding source-side burn. The attack began with social engineering against a LayerZero developer, followed by stolen session material, compromised RPC infrastructure, and disruption of an external RPC provider. Because the pathway used the LayerZero Labs DVN as its sole required verifier, one incorrect attestation was sufficient.

Multi-DVN redundancy had been recommended before the incident, and an earlier Aave risk review had identified inherited LayerZero bridge risk, although it did not identify the exact 1-of-1 pathway later exploited. The warning existed, but no enforced control prevented a high-value path from operating with a single verifier.

THORChain: intake and live signals did not connect

On May 15, approximately $10.7 million was taken from an Asgard vault through a GG20 threshold-signing attack. One malicious validator induced 864 failed signing rounds over roughly two and a half days; three individually low-risk weaknesses combined to leak enough key-share material to reconstruct the vault private key.

In a separate episode, V12 Security reported a critical proposer-forgery vulnerability, supplied a patch, and received no bounty after the issue was fixed. THORChain had also paused its bounty after AI-generated submissions overwhelmed human triage. The exploited bug was not the V12 bug. Together, the two episodes show distinct operational failures: live signals were not correlated in the first, while disclosure intake and adjudication broke down in the second.

ZetaChain failed at adjudication, KelpDAO at control enforcement, and THORChain at intake capacity and signal correlation. A larger bounty alone would not have addressed these failures.

4. AI changes the economics of coverage

The important change is not that AI can find vulnerabilities. It is that the marginal cost of continuous security review is collapsing.

In a 2025 smart-contract experiment, an AI agent scanned 2,849 recently deployed BNB Chain contracts in simulation for $3,476—an average of $1.22 per contract—and uncovered two previously unknown exploitable vulnerabilities. Across four model generations, the median token cost of producing a successful exploit fell 70.2%. The researchers estimate that the same compute budget could generate roughly 3.4 times as many successful exploits as it could six months earlier.

The pattern is not limited to blockchains. In a live penetration test across a university network of roughly 8,000 hosts, ARTEMIS found nine valid vulnerabilities, outperformed nine of ten professional participants, and ran at $18 per hour in one configuration, compared with approximately $60 per hour for a professional penetration tester.

They show that repeated discovery is becoming cheap enough to change the default. Attackers can scan more targets, retry more hypotheses, and keep searching until one exploit pays off. Protocols need the same economics working in their favor.

What we are building at ZeroDrift

At ZeroDrift, we apply AI security directly to live onchain systems. Through our work with Flap, Renaiss, and Sign, we have identified vulnerabilities in production even after those projects had undergone extensive audits by Tier-1 security firms, including CertiK and BlockSec.

Our monitoring continues after the audit. We discover new deployments, compare source code and bytecode, track upgrades and privilege changes, inspect transactions for anomalous behavior, and re-evaluate earlier assumptions as the live system evolves.

Our AI systems can surface hundreds of vulnerability signals across live onchain systems in a single day. But reviewing them with protocol teams, validating them against deployed state, and shipping safe patches can still take weeks. This is why continuous AI coverage is only the first half. The second half is a shared response system that connects protocols, ecosystems, and security teams, so discovery can translate into coordinated action.

Together, we can turn AI-discovered signals into action,before attackers turn them into transactions.

Attackers are already operating at agentic speed. Defenders need to as well.