Certik Issues Warning on AI Attacking Old Smart Contracts
North Korea–linked operators are escalating a wave of crypto thefts, and artificial intelligence is giving them new reach. On May 15, blockchain security firm CertiK warned that legacy smart contracts are becoming soft targets as attackers increasingly use AI to hunt for overlooked flaws. The alert follows one of the most bruising stretches on record for decentralized finance, with hundreds of millions of dollars siphoned in April and May and confidence shaken across key protocols.
“In April, just last month, there were only three days without hacks. More than $690 million was hacked last month in DeFi protocols,” CertiK co-founder and CEO Ronghui Gu said, underscoring the tempo and scale of the damage. Industry trackers counted more than 30 distinct incidents in April alone, with losses well north of $600 million across the ecosystem.
AI supercharges the hunt for legacy bugs
According to CertiK’s analysts, attackers are leaning on AI-driven tooling to rapidly sift through vast troves of on-chain bytecode and open-source repositories, flagging known antipatterns and version-specific pitfalls. Contracts compiled with older toolchains—such as early Solidity 0.6.x—are being singled out because they often predate modern safety defaults, formal verification, or hardening patterns that became standard in later iterations.
The outcome is a widening “attack arbitrage”: even if a protocol’s front-end or core logic seems sound, any connected legacy contract, dusty upgrade proxy, or sidecar module can become the weak link. CertiK says this trend is evident across the recent incident data, where threat actors increasingly chain together subtle oversights and operational gaps, rather than relying solely on novel smart contract bugs.
Two high-impact case studies: Drift Protocol and KelpDAO
Drift Protocol: social engineering opens the door
Drift Protocol—the leading decentralized perpetuals venue on Solana—suffered a serious security incident in April that resulted in approximately $285 million in losses, according to multiple security researchers. Investigators attribute the attack to operators linked to North Korea’s Lazarus Group. Rather than exploiting the core contract, the adversaries reportedly waged a months-long social engineering campaign to gain trust through staged “business” conversations, ultimately convincing members of a security council to pre-sign transactions.
With that foothold, attackers were able to mint fake tokens and post them as collateral, draining protocol vaults in roughly 12 minutes. The damage wiped out more than half of Drift’s total value locked at the time. Post-incident assessments emphasized that the smart contract itself was not breached; human factors and operational security gaps enabled the heist.
KelpDAO: bridge weakness and a single point of failure
Days later, KelpDAO—a prominent liquid restaking protocol that issues rsETH—was hit by a bridge-focused exploit that stole around $292 million, including roughly 116,500 rsETH. The attackers, again linked by researchers to the Lazarus Group, focused on the cross-chain infrastructure Kelp used, which was powered by LayerZero.
Per incident analyses, the adversaries gained control of a remote procedure call (RPC) node—critical for feeding data to transaction verifiers—and simultaneously launched denial-of-service attacks against other nodes to limit visibility. They then injected fabricated on-chain data to simulate a token burn that never occurred. The bogus signal tricked the system into releasing genuine rsETH on Ethereum without real backing. Despite the blow, KelpDAO has since restored operations.
Industrialized crypto theft attributed to DPRK
CertiK’s new report paints a stark picture of North Korea’s systematic involvement in digital asset theft. “North Korea has transformed cryptocurrency theft into a core state revenue mechanism, operating at a scale and level of coordination unmatched in the digital asset ecosystem,” the firm writes. Its analysis, spanning nearly a decade, estimates DPRK-linked actors have stolen about $6.75 billion across 263 incidents from 2016 through early 2026—figures CertiK cautions may be conservative due to underreporting of smaller or early-stage attacks.
The report adds that in the prior year alone, North Korea–linked groups accounted for approximately $2.06 billion in stolen crypto—roughly 60% of global losses—despite representing only about 12% of total incidents. That skew highlights a preference for fewer, larger raids. The trend has persisted into 2026: year-to-date, DPRK activity represents around 55% of global losses, amplified by large exploits such as the roughly $291 million KelpDAO attack. CertiK emphasizes the operations’ sophistication, efficient laundering pipelines, and a continued focus on human and supply chain weaknesses over pure smart contract flaws.
Why “old code” is suddenly high risk
Legacy contracts have always carried risk, but three dynamics now make them prime targets:
- Known weakness catalogs meet AI search: Public vulnerability databases and past audit reports are effectively checklists. AI agents can crawl, cluster, and prioritize contract addresses likely to contain those issues at scale.
- Outdated assumptions and toolchains: Older Solidity versions often lack compiler checks, safe math defaults, or established design patterns that today are standard. Even if a contract wasn’t exploitable then, surrounding ecosystem changes can make once-benign logic dangerous now.
- Neglected dependencies: Orphaned upgrade proxies, aging access-control modules, and third-party integrations can be forgotten. Attackers look for these forgotten pieces to pivot into better-defended core systems.
Crucially, CertiK’s recent casework suggests many losses stem from the seams between code and operations: rushed key ceremonies, single-verifier bottlenecks, weak RPC hygiene, or lax sign-off processes. When attackers blend AI-assisted reconnaissance with carefully staged social engineering, those seams split.
What teams should do now
CertiK’s warning is less about panic than prioritization. For teams stewarding capital on-chain, a pragmatic checklist looks like this:
- Inventory and triage legacy contracts: Map every contract address, compiler version, and dependency. Flag anything built with older toolchains (for example, early 0.6.x) or lacking modern safety patterns.
- Upgrade or deprecate: Where possible, migrate to hardened implementations, add circuit breakers, and retire unneeded modules. If a component cannot be upgraded, sandbox it with strict limits and monitoring.
- Harden cross-chain paths: Eliminate single points of failure. Use multiple independent verifiers, robust light-client or proof-based messaging, and continuous proof-of-reserves checks for bridged assets.
- Raise operational security bars: Enforce multi-party approvals with robust policies, hardware-backed key management, strict signer rotation, and real-time transaction simulation for any privileged action.
- Secure RPC and observability: Treat RPC endpoints as critical infrastructure—use authenticated providers, rate limiting, redundancy across regions, and anomaly detection to catch spoofed or delayed data.
- Attack-surface testing with AI: Don’t let adversaries be the only ones using AI. Employ AI-assisted static analysis and fuzzing across your entire contract graph, including archived and “forgotten” addresses.
- Human-layer defenses: Regularly train staff against social engineering, codify vendor-intake and public comms policies, and conduct tabletop exercises for incident response and bridge deactivation scenarios.
- Public incentives and monitoring: Run active bug bounties, engage third-party monitoring/forensics providers, and set up on-chain alerts for abnormal movements of governance or collateral tokens.
The bottom line
The spike in losses this spring highlights a hard truth: the DeFi stack is only as strong as its oldest links—and attackers now have AI to find them faster. CertiK’s data suggests the most effective adversaries are blending technical reconnaissance with patient social engineering and infrastructure tampering. Teams that aggressively retire legacy risk, eliminate single points of failure, and professionalize operational security will fare best as the arms race intensifies.
Related reading: Thorchain Suffers Multi-Chain Exploit — $10M+ Drained Across Blockchains
