AI Is Quietly Transforming Crypto Security with Faster, Smarter Smart Contract Audits
Smart contract audits used to be slow and expensive, but it’s changing fast.The arrival of AI systems designed to autonomously hunt for code vulnerabilities is pushing the cost of basic audits toward zero. Work that once took weeks and significant budget could soon be done in minutes. Projects that never had the money for a professional review can now get one quickly.
Alexander Urbelis, chief information security officer at ENS Labs, put it plainly. He said these tools are pushing the price of a basic audit toward zero. For years, automated tools called fuzzers hunted for bugs by bombarding programs with random inputs. AI works differently. It reasons through code the way a human attacker would.
Urbelis described this as a change in degree that could cause a change in kind. Machines have hunted bugs for years, he said, but a fuzzer that can reason is something new entirely.
Instead of just flagging technical errors, these systems can infer what a piece of code was meant to do and compare that against what it actually does. In crypto, where contract code is public and bug bounties can be large, this could meaningfully expand how many vulnerabilities get caught before launch.
David Schwed, COO of blockchain security firm SVRN, sees an even bigger shift coming. He said these models now operate the way a human attacker does. They iterate. They adjust based on what they see in real time. Older tools ran fixed, deterministic checks.
Schwed argued the real change might not be about finding bugs at all. Continuous auditing could become standard, with suggested fixes delivered at a fraction of today’s cost. Teams would no longer be stuck with a single point-in-time review they can barely afford once.
If audits become cheap and constant, expectations around due diligence will likely shift too. Urbelis believes AI could reshape the industry’s standard of care. Teams used to point to cost and complexity as reasons certain checks were skipped. That argument gets harder to make once sophisticated analysis is available on demand.
A clean AI report will not count as a defense, Urbelis said. He expects the opposite argument to surface instead: the tool existed, it was cheap, and the team should have used it.
This raises a bigger question for the industry. If AI audits become routine, will investors start expecting them before funding a project? Could skipping one eventually look like negligence?
Still, neither researcher believes AI will replace human auditors anytime soon. Machines are strong at spotting coding flaws. They remain weaker at catching the economic and incentive-driven vulnerabilities behind some of crypto’s biggest losses.
Urbelis said the bugs that drain treasuries often come down to intent and adversarial incentives. Those still need an experienced person in the room.
Schwed made a similar point. Telling an AI tool to audit a contract and make no mistakes is not a security program, he said. If the person running the tool cannot evaluate the results, they have not bought security. They have bought a false sense of it.
Both researchers noted that many of crypto’s costliest hacks had nothing to do with smart contract bugs. The Drift exploit stemmed from a months-long social engineering campaign targeting trusted contributors, not the protocol’s code. Ronin and Bybit involved compromised keys and manipulated signing processes.
No code scanner can stop an authorized signer from approving a transaction they cannot verify, Schwed said.
AI will not solve every security problem in crypto. But it is already changing one part of the equation: how bugs get found, and what counts as reasonable effort to find them.
