The cryptocurrency space has long been plagued by hacking incidents and security breaches. However, the emergence of artificial intelligence (AI) has significantly exacerbated this threat. Charles Guillemet, Chief Technology Officer at Ledger, a prominent crypto wallet provider, emphasizes that the economics of cybersecurity are deteriorating as AI tools render it faster and more affordable to launch attacks on systems. 'Identifying vulnerabilities and exploiting them has become remarkably easy,' Guillemet stated in an interview.
'The cost is essentially dropping to zero.' His comments come amidst a surge in high-profile crypto heists, including the recent exploitation of Solana-based decentralized finance protocol Drift, which resulted in the theft of $285 million worth of digital assets. This incident is one of the most severe exploits of the year so far.
The week prior, an attack on yield protocol Resolv led to $25 million in losses. According to data from DefiLlama, the total value of assets stolen or lost in crypto attacks over the past year exceeds $1.4 billion.
The traditional security paradigm has relied on an imbalance, where the difficulty and expense of hacking a system outweigh the potential rewards. Nevertheless, AI is eroding this advantage. Tasks that previously required skilled researchers months to complete, such as reverse engineering software or chaining exploits, can now be accomplished in mere seconds with the right prompts. For the crypto industry, where code often governs large pools of funds, this shift significantly raises the stakes.
'You need to be perfect,' Guillemet cautioned teams developing blockchain protocols. The problem is further complicated by AI-generated code, as the increasing reliance on AI tools by developers may lead to the rapid dissemination of vulnerabilities. 'There is no "make it secure" button,' he said. 'We are going to produce a lot of code that will be insecure by design.' To address this issue, crypto protocols must rethink security from the ground up.
Guillemet advocates for formal verification, which involves using mathematical proofs to validate code, as a more robust approach than traditional audits, which may overlook bugs. He also recommends hardware-based security, such as devices like hardware wallets that isolate private keys from internet-connected systems, thereby reducing exposure.
'When you have a dedicated device not exposed to the internet, it is more secure by design,' he said. This approach is becoming increasingly relevant as malware grows more sophisticated.
Guillemet described attacks that scan compromised phones for wallet seed phrases, allowing hackers to drain funds without user interaction. For average crypto users, Guillemet's message is straightforward: assume that systems can and will fail.
'You can’t trust most of the systems that you use,' Guillemet said. This may drive more users toward cold storage, stronger operational security, and keeping sensitive data offline.
Even then, risks extend beyond software, including physical attacks targeting crypto holders. Guillemet anticipates a divide in the future, where critical systems like wallets and protocols will invest heavily in security and adapt, while much of the broader software ecosystem may struggle to keep up. 'It’s really easier to hack everything,' he said.