For years, artificial intelligence has played a supporting role in crypto security: flagging anomalies, summarizing alerts and preparing reports that humans ultimately acted on. A new report from blockchain security firm CertiK argues that arrangement is ending. According to the company’s Intel3D report, agentic AI — systems that can reason through multiple steps, call external tools and APIs, collect evidence and take actions in live environments — is becoming part of the crypto security workforce itself, investigating threats, tracing stolen funds and even acting on incidents with limited human intervention.
The shift matters for anyone holding digital assets. As crypto attacks have become faster and more complex, CertiK sees AI agents taking on smart contract analysis, live transaction monitoring and cross-chain fund tracing — work once handled exclusively by experienced human analysts. The report describes the emerging model as an “AI security workforce,” in which autonomous systems operate within defined roles while human experts move toward supervision, quality control and accountability.
## From security assistant to operator
In a security operations center, CertiK said, an autonomous system could investigate an unusual login, retrieve device fingerprint and location history, compare the information against threat intelligence, decide whether an account should be suspended, and execute the suspension — recording its reasoning for human review along the way.
The pressure to automate is partly driven by the sheer speed of crypto attacks. Flash loan exploits can drain protocols within seconds, and stolen assets can move through multiple addresses, bridges and mixing services within hours. The financial stakes remain substantial: crypto losses reached 768.4 million USD in September across 97 incidents under CertiK’s methodology, and the firm’s figures placed total losses during 2026 at roughly 2.68 billion USD by the end of September. In the first half of the year, losses stood at 1.32 billion USD, down 46.8% from a year earlier, with wallet compromises becoming the largest attack method during the second quarter.
## Agents on the audit front line
Smart contract auditing has traditionally combined manual code review with static analysis, symbolic execution and fuzzing — tools that could surface potential vulnerabilities but left humans to judge whether findings were genuine. CertiK says agentic systems can now move through a contract’s call graph, analyze state changes across several contracts and external calls, and hunt for vulnerabilities involving reentrancy, oracle manipulation, access controls and unsafe upgrade mechanisms.
AI is also being applied to formal verification, with agents generating formal specifications and testing them against contract behavior, reducing some of the manual work previously required from formal methods engineers. Human auditors remain part of the process, but their work increasingly centers on verifying AI-generated findings and checking where automated systems themselves may have blind spots.
Crucially, the report extends automated security beyond the audit stage into live operations. AI systems can watch pending and confirmed blockchain transactions for flash loan attacks, oracle manipulation and abnormal liquidity withdrawals — and in more advanced setups, detection can trigger an automated response within the same block window. An agent could pause a vulnerable contract function, activate a circuit breaker or freeze a compromised administrator key without waiting for a person to manually execute the response.
## Tracing stolen funds across chains
Fund tracing is another area being transformed. Investigators have traditionally followed stolen assets from address to address, reconstructing how funds pass through intermediary wallets, mixers, bridges and exchanges — work that becomes harder as assets are split and moved across several blockchains. CertiK said agentic systems can perform this process continuously, following assets as they move instead of reconstructing the path after the fact, and can combine activity from different chains into a single investigation.
The report cited laundering connected to the Bybit exploit as an example, noting that previous CertiK research documented the conversion of 86.29% of stolen ETH into Bitcoin within one month through mixers, bridges and over-the-counter brokers.
## The new attack surface
CertiK’s warnings are as pointed as its optimism. Agentic systems can produce incorrect information while expressing high confidence — an AI-generated suspicious activity report could contain an incorrect transaction trail, or an audit agent could wrongly conclude that a formal specification protects against a vulnerability. Human reviewers may also grow less likely to catch such errors as they place more trust in automated output over time.
Security agents themselves can become targets. Because they may have permission to interact with sensitive systems, CertiK said prompt injection or manipulation of an agent’s inputs could potentially cause autonomous actions such as approving a fraudulent transaction or disabling a legitimate security control. Attackers already use AI to speed up vulnerability discovery, automate reconnaissance and craft more convincing social engineering campaigns.
Liability also remains unresolved across jurisdictions when autonomous actions cause harm. CertiK’s recommendations are concrete: keep complete audit trails of agent inputs, reasoning and actions; set clear limits on decisions agents can make independently; test systems against adversarial manipulation; and assign a named human owner responsible for each agent’s performance and failures.
For DeFi users, the takeaway is double-edged. Autonomous defenses may eventually make protocols harder to exploit in real time — but the same technology, in the wrong hands or poorly supervised, adds an entirely new category of risk to an already fast-moving threat landscape.
2.68 billion lost this year and the report still says the quiet part: attackers get the same AI. automated recon and social engineering cuts both ways
and the defense side finally scales the same way. one agent watching 50 chains beats 50 firms watching one each, its just a faster arms race now
one agent watching 50 chains is also one agent with credentials on 50 chains. the certik report is right about scale and quiet about blast radius. consolidate the defense, consolidate the target
the blast radius point is underrated. one compromised agent credential and your security layer becomes the attack surface itself. isolated signing keys at minimum, ideally per chain
per chain keys and rotate them often. the agent needs read access everywhere plus one scoped signer small enough to lose safely
scoped signer is the part people skip, one read-everywhere agent with a tiny write key you can rotate in seconds. blast radius of that setup is close to zero
per chain keys plus one scoped signer solves most of this. a single credential across 50 chains is just a bigger target wearing a security badge
cross chain fund tracing by autonomous agents is the genuinely new part here. stolen funds used to hop bridges faster than any human analyst could follow
Prompt injection against a security agent that can freeze admin keys is a genuinely new threat model. The named human owner recommendation should be mandatory, not a suggestion.
@Hedda right, and metamask already shipping agent wallets that can trade and hold funds means we audit bots like staff now. wild timeline
prompt injection into an agent with freeze authority is the nightmare case. one poisoned advisory feed and the bot bricks a live protocol mid-migration
poisoned advisory feed is the realistic vector for sure. signed sources on every input the agent reads is boring but it closes most of that hole
co-sign everything and by the time a human reviews, the exploit tx is three bridges away. bounded pause authority, like 10 minutes, is probably where this lands
ten minutes is the right ceiling honestly, cross chain hops take longer than that anyway
New risks for DeFi users is doing heavy lifting in that headline. AI watching contracts in real time is only good if the AI is on your side of the trade.
agents pausing a vulnerable function in the same block window is cool until a false positive bricks a legit protocol during a migration lol. supervision layer better be good
staged rollout fixes half of this, agent gets pause authority on test deploys first. but yeah the live mainnet case needs a human co-signer before anything freezes
test deploys wont catch the adversarial part tho. nobody feeds poisoned advisories to a staging bot, the first honest test is live money moving
staging can simulate adversarial feeds if you pay a red team to poison them. firms just never budget for that part
you absolutely can feed poisoned advisories to a staging bot, red teams do it for a week. the honest problem is nobody keeps that harness running after launch
false positives already happen with regular monitoring tools, the difference is a bot with pause authority doesnt wait for anyone to confirm. hard rate limits on autonomous freezes would solve half of this
the false positive problem compounds with authority. an agent that pauses a function on a bad signal and an attacker who learns what triggers the pause are the same discovery loop. that is a new attack surface not a bug
^ this. reasoning plus tool calls is fine for triage, giving it the pause button during a live migration is where the false positive bill comes due
768 million in september losses alone and certik still has to say humans move to supervision. the job title changes, someone still owns the freeze call at 3am
an agent tracing stolen funds across chains in minutes instead of weeks is the real upgrade. its the action authority that needs guardrails, not the analysis
intel3d framing agents as a workforce with roles and supervision is smart language but the 2.68 billion lost this year sets the budget. firms are not buying autonomy, they are buying analyst leverage at 3am
2.68 billion lost this year and the pitch is fewer humans in the loop. let the agents trace funds across bridges all day, just keep a person holding the freeze button