‘It’s an unfair game’: CertiK CEO says DeFi attackers using AI to outspend defenders

Crypto and decentralized finance security researchers are warning that artificial intelligence is tipping the scales in favor of hackers over defenders after a particularly rough stretch of DeFi exploits this year.

"In April, just last month, there were only three days without hacks," CertiK co-founder and CEO Ronghui Gu said during an interview with The Block's Gareth Jenkinson at the Consensus Miami conference. "More than $690 million got hacked last month in DeFi protocols."

If the February 2025 Bybit exploit is excluded, Gu said April marked the highest monthly financial loss from DeFi hacks since March 2022.

Gu attributed much of the recent surge to AI tools that are making it easier for attackers to discover vulnerabilities and replicate attacks across protocols. He called this "an unfair game" because attackers can pour computing resources into probing a single protocol for weaknesses while security firms are forced to spread resources across dozens of clients.

Still, he argued that no system can ever be universally bug-free, pointing to what he called the "halting problem," a computer science limitation on how programs will behave in every scenario.

"Even if you run an AI model for 30 hours and it doesn't find a vulnerability, it can't prove that your code is bug-free," Gu said. "The only known way is through formal verification."

DeFi attack spree

The April incidents Gu alluded to include attacks on Drift Protocol and Kelp DAO that together accounted for nearly $600 million in losses. They also gave security experts a closer look at how attackers are shifting their strategies.

Gu said that because smart contract auditing standards have improved significantly over the years, hackers are now going after security and supply-chain vulnerabilities instead of code flaws.

"Smart contracts become safer, so hackers look for supply chain, operational security, and so on," Gu said. "The industry and most projects right now don't pay enough attention to this."

Drift Protocol, which suffered an exploit estimated at around $280 million in April, later linked the breach to an admin takeover tied to suspected North Korean attackers.

Kelp DAO's $292 million exploit similarly stemmed from infrastructure and governance failures. Gu pointed to reporting that attackers compromised a LayerZero validator setup before routing stolen assets through Aave. That attack triggered a controversial freeze of roughly $72 million in assets by Arbitrum that then became tied up in legal disputes after plaintiffs from separate North Korean terrorism judgments sought to claim the funds as restitution.

Gu said these episodes illustrate just how complex incident responses have become in crypto as protocols, blockchain, and exchanges have to race against bad actors to coordinate freezes and recoveries.

"The industry needs to work together," Gu said. "How to react as fast as possible to reduce the loss. How the community can work together to freeze tokens."

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.