Old smart contracts are getting a new auditor. Attackers can rent it too.
Lab agents now triage and exploit old smart contracts in simulation. Security firms say attackers are already using the same economics on DeFi’s long tail. Confirmed AI authorship of any single live drain remains scarce. The capability evidence is not.
Give a capable language-model agent a dusty contract address, a sandbox fork of the chain, and a few developer tools. The loop stops looking like a chatbot. It looks like a junior exploit developer who never sleeps: ingest verified source, guess the bug, write Solidity, run it, revise, drain.
Lab benchmarks now put hard numbers on that loop. Across hundreds of historically drained contracts, frontier agents recover more than half the old paths in simulation, for hundreds of millions in paper value. What changed in 2026 is the cost of looking again at code that has been sitting in public for years.
News analysis · Security Lab
Old code, new eyes
In May 2026, researcher Taylor Hornby, working for Shielded Labs, used Claude Opus 4.8 inside a custom audit harness and found a soundness flaw in Zcash’s Orchard shielded-pool circuit. The bug dated to Orchard’s activation in May 2022. In a local regtest, Hornby generated unlimited counterfeit ZEC. Orchard is not a smart contract, but it is one of the cleanest documented cases of an AI-assisted white-hat beating years of human scrutiny on public crypto code. Developers patched within days. Cryptography cannot prove whether anyone exploited the window before the fix.
Coldcard was messier. Attackers swept bitcoin from wallets tied to a firmware entropy weakness that entered seed generation with a March 2021 migration, described in Coinkite’s July 30, 2026 technical backgrounder. Secondary reporting, including CBC News, put losses above $100 million. Coinkite wrote that because COLDCARD firmware has long been public, “we have to assume that someone used AI to review previous versions of our firmware.” The same backgrounder adds that a few weeks earlier, Coinkite “used one of the best available AI models to review our code for security issues, and it did not find this bug or anything serious.” Attribution of the live sweeps is unsettled. The confirmed fact is a five-year-old public-code defect becoming economically live.
Legacy hunting got cheap
DL News (Tim Craig, March 26, 2026) reported that offensive use of chatbot-class models is already visible to practitioners. Gabi Urrutia, field chief information security officer at Halborn, told the outlet that AI has made “legacy-contract hunting cheaper, faster, and more scalable,” especially for old forks, dusty deployments, under-maintained vaults, and inherited code paths. “AI does not need to invent novel vulnerability classes to create more damage; it only needs to find old ones faster and at scale,” Urrutia said. Stephen Ajayi, dapp audit technical lead at Hacken, described repeated, identical exploit attempts across many contracts at once. Gerrit Hall, co-founder of Firepan, argued that “offensive capacity is improving far faster than defensive tooling.” That is attributed industry reporting. Ethereum-compatible rails still hold years of immutable bytecode with balances attached.
$550 million in paper drains
In a December 1, 2025 research post, Anthropic Fellows and MATS scholars introduced SCONE-bench: 405 smart contracts exploited between 2020 and 2025 across Ethereum, BNB Chain, and Base. The harness forks the chain at a historical block, retrieves the target’s verified source and metadata, and injects that material into the agent’s prompt and Docker environment. Agents get tools (including Foundry) with a 60-minute limit. Success means raising the executor’s native-token balance by a meaningful threshold. Bytecode reverse-engineering is a different attack surface, covered below with unverified contracts.
| Slice | What Anthropic reported | Money metric |
|---|---|---|
| Full historical set | 10 frontier models, Best@8: turnkey exploits for 207 of 405 contracts (51.11%) | $550.1 million simulated stolen funds (aggregate of per-problem maxima across models) |
| Post knowledge-cutoff 2025 exploits | Opus 4.5, Sonnet 4.5, and GPT-5 collectively produced exploits for 19 problems (55.8%). Opus 4.5 alone: 13 of 20 (65%) after its June 1, 2025 cutoff | Collective maximum $4.6 million simulated; Opus 4.5 alone about $3.7 million |
| Recently deployed, no known vulns | Sonnet 4.5 and GPT-5 vs 2,849 BSC ERC-20s filtered for liquidity (run Oct 3, 2025): two novel zero-days | $3,694 simulated proceeds; GPT-5 API cost about $3,476 for the sweep |
Separate the trajectories. Anthropic’s conclusion states that in about a year, post-cutoff success rate rose from roughly 2% to 55.88%, while total exploit revenue climbed from about $5,000 to $4.6 million. The chart claim that revenue roughly doubled every 1.3 months is the revenue path, not a restatement of the success-rate leap. The work stayed in simulators. Anthropic states it never tested exploits on live blockchains and had no impact on real-world assets.
Of the post-cutoff $4.6 million, the top two vulnerabilities (fpc and w_key_dao) account for 92% of the simulated total (Figure 3 note). A small number of high-impact flaws dominate the dollar metric. On the novel sweep against those 2,849 verified BSC ERC-20s, Anthropic reports $3,694 in simulated proceeds against about $3,476 in GPT-5 API cost: a $218 surplus over API spending before other costs. That is a narrow surplus in simulation, not established real-world profitability. Anthropic’s cost footnotes also report an average net of about $109 per exploit on that sweep; treat that as a lab accounting line over API spend, not proven live net profit.
In the novel sweep, one bug was a missing view modifier on a public “calculator” function that could inflate balances. The other was a fee-claim path that failed to validate a beneficiary. For that fee-claim bug, Anthropic says a real attacker independently drained about $1,000 of fees four days after the agent’s discovery.
Secondary coverage sometimes compresses the slices. DL News summarized Anthropic as agents exploiting “63%” of the 405-contract set for a hypothetical $4.6 million. That 63% figure is not in Anthropic’s post. Anthropic’s primary separates full-set 51.11% and $550.1 million from post-cutoff 55.8% and $4.6 million.
Address in, working exploit out
In the preprint “AI Agent Smart Contract Exploit Generation” (arXiv:2507.05558), Arthur Gervais and Liyi Zhou describe A1: an agentic wrapper that turns a general LLM into an end-to-end exploit generator. Hypothesize bugs. Write proof-of-concept Solidity. Report only what executes cleanly on forked chain state. Under the paper’s assumptions, attackers can clear profitability near $6,000 exploit values while defenders need on the order of $60,000. On VERITE, A1 reached 62.96% (17 of 27), extracting up to about $8.59 million USD per case and about $9.33 million total in simulated value.
Exploit mode outruns patch mode
OpenAI’s EVMbench (February 18, 2026), built with Paradigm, sharpens the asymmetry. On curated high-severity bugs in isolated Anvil environments, agents do best when the objective is explicit fund drainage. GPT-5.3-Codex via Codex CLI scored about 71% in exploit mode, up from GPT-5’s about 33% roughly six months earlier. Detect and patch stayed far from full coverage.
Unverified code and the long tail
Chainalysis (June 9, 2026) identified at least $36.7 million stolen over six months from protocols whose own contracts were unverified on explorers at the time of the exploit. Four incidents make up the cluster. Truebit alone accounts for $26.2 million on Chainalysis’s table (January 8, 2026), followed by Trusted Volumes ($5.9M), Aperture Finance ($3.2M), and Ekubo ($1.4M). Chainalysis frames AI-assisted analysis as a likely accelerator for scanning decompiled output at scale.
CertiK’s Hack3D H1 2026 report (July 6, 2026) recorded 204 of 344 incidents as code-vulnerability cases, about $152 million of about $1.32 billion lost in the half. CertiK also notes a rising share of those incidents on contracts more than one year old.
Truebit’s old overflow
On January 8, 2026, Truebit suffered a major exploit. CertiK’s incident analysis attributed roughly $26.6 million of impact to an integer-overflow path in purchase-price logic on a contract compiled with pre-0.8 Solidity, before default overflow checks. The primary attacker minted TRU for zero ETH via a crafted amount that overflowed an addition, then sold into ETH for about 8,535 ETH in-transaction. Chainalysis later listed the same incident at $26.2 million inside its unverified-contract cluster and pinned the vulnerable contract to Solidity v0.5.3.
Urrutia, speaking to DL News, called Truebit a likely AI-triage candidate. That is analyst speculation. The verified facts are the overflow, the pre-0.8 compiler generation, the unverified deployment, and the loss size. Sandbox scores do not, by themselves, prove this live drain was AI-authored.
Why the long tail still pays
A contract that still holds value five years after deployment cannot be silently patched the way a web API can. Solidity 0.8+ added default overflow checks; many still-funded deployments predate that habit. Audits age. Maintainers leave. Forks inherit bugs. Urrutia’s line in DL News is the operational punchline: “‘Audited once’ is no longer a serious security model.” Ajayi’s prescription is continuous adversarial testing with the same class of agents attackers can rent.
What to watch
- Whether security firms publish reproducible methods for attributing agent-driven reconnaissance.
- Whether protocol teams adopt continuous AI red-teaming on production deployments, and whether unverified contracts get verified or monitored in real time.
- Whether future incident reports document model-assisted exploit development with primary evidence.
- Whether defensive agent scores on detect and patch close the gap exploit mode currently shows.
Related: Liquid cache-key peg-out; Chainflip Tron memo refunds; bridge bounty doctrine split.
Machines make it cheaper to look again. An AI-assisted researcher discovered the Orchard flaw, which developers subsequently patched. Coldcard shows the opposite outcome on public firmware: a years-old defect became economically live, while AI authorship of the sweeps remains unsettled. DeFi still holds years of public contracts with balances attached. Confirmed AI authorship of any single named live drain remains scarce. The hunt is no longer scarce.
