Immunefi CEO Links AI Models to Resurgence in DeFi Hacks

Immunefi CEO Mitchell Amador told Cointelegraph at the WAIB Summit in Monaco that the proliferation of frontier AI models, including Claude Opus 4.8 and ChatGPT 5.5, is a main driver behind a resurgence in DeFi hacks in 2026, calling the shift a "vulnerability apocalypse" that favors attackers. Citing DefiLlama data, Cointelegraph reported that illicit actors stole more than $634 million from crypto platforms in April 2026, the highest monthly total since roughly $1.4 billion in losses in February 2025, driven in large part by the Bybit hack. Amador said the crypto industry has a three-to-four-year window to build "impregnable" codebases using the defensive capabilities of the same AI models, a window he said could shrink to under two years if crowdsourced security solutions scale faster.

Amador's comments followed Anthropic's release of Fable 5; Anthropic said the model has safeguards that reroute cybersecurity-related topics to Claude Opus 4.8, a response to industry concern that new frontier models could accelerate exploit development. The warning also lands amid a string of large 2026 DeFi exploits, including an April 19 attack that drained roughly $290 million to $293 million in restaked Ether from Kelp DAO's LayerZero-powered bridge; LayerZero said the loss traced to Kelp DAO's single-verifier bridge configuration, which LayerZero had previously advised against.

Amador's framing, AI models as an attacker force-multiplier, matches a broader pattern security researchers have described: code-generation and semantic-reasoning improvements in frontier models can shorten the time needed to find and weaponize smart-contract logic bugs compared with fully manual audits. That cuts both ways, since the same capabilities are also being pitched, including by Amador himself, as tools for faster auditing, fuzzing and bug-bounty triage; the practical question for protocol teams is whether defensive-tooling adoption keeps pace with attacker adoption.

For teams building or auditing DeFi protocols, the immediate takeaways are to treat AI-assisted exploit development as a live threat model rather than a future one, to note that bridge and cross-chain verifier misconfiguration (like Kelp DAO's single-DVN setup) keeps surfacing as a recurring root cause independent of AI, and to track whether major model providers add explicit guardrails, the way Anthropic has for Fable 5, around cybersecurity and exploit-adjacent prompts.

Watch monthly DefiLlama loss figures for whether April's spike persists or reverses, whether other bug-bounty platforms and auditors corroborate Amador's "vulnerability apocalypse" framing with their own data, and whether more model providers publish safeguards or usage policies specifically addressing smart-contract exploit generation.