DeFi Faces 'Unsafe' Label Amid AI-Driven Security Threats
Artificial intelligence is intensifying security concerns in decentralized finance (DeFi), with experts split over whether the sector is fundamentally unsafe or can adapt to new exploit capabilities. The debate comes as April 2026 recorded $651 million in crypto hack losses—the highest monthly total since 2022—highlighting the urgency of the discussion.
Manuel Aráoz, founder of blockchain security platform OpenZeppelin, sparked controversy on social media by declaring “all of DeFi unsafe.” He pointed to AI coding agents’ growing ability to identify vulnerabilities in smart contracts as a key driver of risk. Aráoz’s statement has divided the crypto community, with some arguing that smart contract flaws are overemphasized, while others call for AI to be used as a defensive tool to counter these threats.
AI's 'Dual Threat' to DeFi
Yu Xian, founder of blockchain security firm SlowMist, highlighted what he called a “dual threat” from AI-empowered attackers. These include black-hat hackers leveraging AI tools to automate exploits and organized groups using AI for social engineering attacks. To stay ahead, Yu advocated for DeFi teams to integrate advanced AI-powered detection tools, covering both on-chain vulnerabilities and off-chain attack vectors.
“DeFi teams must be more diligent than black hats,” Yu said, warning that the sophistication of automated attack capabilities is rapidly evolving.
The latest wave of DeFi attacks underscores the sector’s vulnerabilities. April 2026 saw high-profile incidents such as the $292 million Kelp DAO bridge exploit and a $285 million attack on Drift Protocol. These attacks, combined with May's $328.6 million in bridge-related exploits tracked by PeckShield, are pushing 2026 toward being one of the worst years on record for DeFi security breaches.
Is DeFi Uniquely Exposed?
While some analysts suggest AI is directly driving DeFi exploits, Meir Dolev, CTO of blockchain security firm Cyvers, noted there is limited forensic proof of AI-led attacks. However, he emphasized that DeFi is uniquely exposed due to its design. Publicly visible code, instant fund transfers, composable contracts, and interconnected systems make DeFi an attractive target where “one mistake” can lead to catastrophic losses.
Dolev identified key attack surfaces: smart contract logic, admin keys, DevOps processes, front-end interfaces, and human-layer vulnerabilities like social engineering. He warned that AI lowers the barriers for attackers to probe these areas at scale.
“DeFi is still fixable, but only if security becomes an always-on process, not a pre-launch checkbox,” Dolev said. He recommended measures including real-time AI-assisted code reviews, continuous transaction simulations, and stronger key management practices to mitigate risks.
Market Resilience Amid Security Risks
Despite the elevated risk environment, DeFi remains active, with total value locked (TVL) standing at $13.14 billion as of late May 2026. This reflects a continued appetite for DeFi protocols, even as security concerns intensify. However, the sector’s resilience will be tested if large-scale exploits persist.
With AI-driven threats reshaping the threat landscape, the debate over DeFi's safety is more than academic. Whether the sector can adapt to these challenges will likely determine its trajectory in an increasingly hostile environment for decentralized finance.