AI-Driven Attacks Fuel Major Crypto Thefts in 2026

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

In 2026, over $600 million was stolen in crypto hacks, with AI systems enabling large-scale attacks. North Korean-linked groups used AI for social engineering, deepfakes, and automated vulnerability scanning, leading to major breaches at Kelp DAO, Drift Protocol, and Zerion. AI's role has amplified the scale and sophistication of these incidents.[AI generated]

Why's our monitor labelling this an incident or hazard?

The article explicitly mentions AI being used in social engineering attacks that resulted in theft, AI-powered deepfakes and voice manipulation tools sold for bypassing security, and autonomous AI agents conducting attacks. These uses of AI have directly caused significant financial harm, fulfilling the criteria for an AI Incident. The harms are realized, not just potential, and the AI systems' development and use are pivotal in enabling these attacks. Therefore, this event is classified as an AI Incident.[AI generated]
AI principles
Robustness & digital securitySafety

Industries
Digital securityFinancial and insurance services

Affected stakeholders
ConsumersBusiness

Harm types
Economic/PropertyReputational

Severity
AI incident

Business function:
ICT management and information security

AI system task:
Content generationEvent/anomaly detection


Articles about this incident or hazard

Thumbnail Image

Phishing, Deepfakes To Fuel 2026's Biggest Crypto Hacks

2026-04-23
Cointelegraph
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions AI being used in social engineering attacks that resulted in theft, AI-powered deepfakes and voice manipulation tools sold for bypassing security, and autonomous AI agents conducting attacks. These uses of AI have directly caused significant financial harm, fulfilling the criteria for an AI Incident. The harms are realized, not just potential, and the AI systems' development and use are pivotal in enabling these attacks. Therefore, this event is classified as an AI Incident.
Thumbnail Image

Crypto lost $600M to hacks in 2026, AI is making it worse

2026-04-23
The News International
Why's our monitor labelling this an incident or hazard?
The article explicitly links AI-powered techniques to successful cyberattacks resulting in financial losses, including a $100,000 theft via AI-driven social engineering and the sale of AI-based deepfake tools for bypassing security checks. These constitute direct harms to property and financial assets caused or facilitated by AI systems. Therefore, the event meets the criteria for an AI Incident, as AI's use in the attacks has directly led to significant harm. The mention of defensive AI and government responses provides complementary context but does not overshadow the primary incident nature of the report.
Thumbnail Image

Phishing, Deepfakes, and Supply Chain Attacks to Drive 2026's Biggest Crypto Hacks: CertiK - FinanceFeeds

2026-04-23
FinanceFeeds
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions AI-generated deepfakes and automated AI tools that enable more convincing phishing and faster, more effective attacks. These AI systems are directly contributing to significant financial losses in the crypto ecosystem, which constitutes harm to property. The involvement of AI in the development and use of these attack methods, and the resulting realized harm (multi-million dollar exploits), fits the definition of an AI Incident. The article does not merely warn of potential future harm but reports ongoing and realized attacks facilitated by AI.
Thumbnail Image

CertiK warns AI misuse and infrastructure gaps to drive 2026 crypto hacks

2026-04-23
crypto.news
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions AI systems being used maliciously to automate exploit development, generate deepfakes for social engineering, and conduct attacks at machine speed, which have directly resulted in large-scale thefts and security breaches in the crypto ecosystem. These are clear examples of AI systems' use leading to realized harm (financial loss and security compromise), fitting the definition of an AI Incident. The mention of defensive AI use and broader threat environment context complements the incident description but does not overshadow the primary classification as an AI Incident.
Thumbnail Image

Phishing, Deepfakes to Dominate Crypto Hacks by 2026: CertiK

2026-04-23
blockchain.news
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions AI-enabled social engineering used in a hack that resulted in theft, and describes how AI tools are being used offensively to generate deepfakes and scan for vulnerabilities, leading to large-scale financial losses. These constitute direct harms to property and communities. Therefore, the event qualifies as an AI Incident because the development and use of AI systems have directly led to significant financial harm through cyberattacks. The discussion of defensive AI and regulatory responses serves as complementary information but does not negate the presence of realized harm.
Thumbnail Image

Hackers Armed With AI Stoke Fears for $130 Billion Crypto Sector

2026-05-15
Yahoo! Finance
Why's our monitor labelling this an incident or hazard?
The article explicitly discusses the use of AI by hackers to enhance their ability to find vulnerabilities and execute complex exploits in DeFi protocols, which are automated blockchain-based financial systems. These AI-enabled attacks have directly caused large-scale financial theft and operational disruption, fulfilling the criteria for an AI Incident. The involvement of AI is reasonably inferred from the description of rapid vulnerability detection and sophisticated attack planning attributed to AI models. The harms include significant financial loss and disruption to the management and operation of critical financial infrastructure (DeFi platforms).
Thumbnail Image

AI-Hacking Threat Pushes $130 Billion Crypto Sector to the Brink

2026-05-15
Bloomberg Business
Why's our monitor labelling this an incident or hazard?
The event involves AI systems being used by hackers to carry out complex cyberattacks on cryptocurrency platforms, leading to direct financial harm (loss of hundreds of millions of dollars), disruption of platform operations (shutdowns and failures), and harm to the crypto community (investor exodus and ecosystem instability). The AI involvement is reasonably inferred from expert analysis and the sophistication of the attacks. The harms fall under (d) harm to communities and property (financial assets). Hence, this is an AI Incident as the AI system's use directly led to significant harm.
Thumbnail Image

AI-hacking threat pushes $130 billion crypto sector to the brink

2026-05-15
Business Standard
Why's our monitor labelling this an incident or hazard?
The event involves the use of AI systems by hackers to carry out sophisticated cyberattacks on DeFi platforms, directly causing significant financial harm to investors and platforms, which qualifies as harm to property and communities. The AI's role in planning and executing the hacks is pivotal, and the harm has already occurred. Therefore, this is an AI Incident as per the definitions, since the AI system's malicious use directly led to realized harm.
Thumbnail Image

AI-hacking threat pushes US$130bil crypto sector to the brink

2026-05-16
The Star
Why's our monitor labelling this an incident or hazard?
The event involves the use of AI systems by hackers to carry out cyberattacks that have directly caused substantial financial harm (harm to property and communities) and disruption within the crypto sector. The AI's role in enabling the attacks is pivotal, as it allowed hackers to identify vulnerabilities and design exploits more efficiently and effectively than before. The harms are realized, including theft of hundreds of millions of dollars, platform shutdowns, investor losses, and cascading effects across the DeFi ecosystem. Therefore, this qualifies as an AI Incident due to the direct and significant harm caused by AI-enabled malicious use.
Thumbnail Image

Hackers armed with AI stoke fears for $130 billion crypto sector

2026-05-15
ArcaMax
Why's our monitor labelling this an incident or hazard?
The article explicitly states that AI was used by hackers to plan and execute sophisticated crypto heists, which caused realized financial losses, platform shutdowns, and investor panic. These outcomes constitute harm to property and communities. The AI involvement is central to the incident, as it enabled the hackers to identify vulnerabilities and design exploits more efficiently. This fits the definition of an AI Incident because the AI system's use directly led to significant harm. The article does not merely speculate about future risks but documents actual attacks and their consequences.
Thumbnail Image

AI-hacking threat pushes $130bn crypto sector to the brink

2026-05-15
Moneyweb
Why's our monitor labelling this an incident or hazard?
The article explicitly discusses the use of AI by hackers to carry out crypto thefts resulting in hundreds of millions of dollars lost and platform failures. The AI system's use in planning and executing these attacks directly led to significant financial harm and disruption in the crypto sector. This meets the criteria for an AI Incident because the AI system's use in the attacks directly caused harm to property and communities. The involvement of AI is reasonably inferred from expert statements and the nature of the attacks, fulfilling the definition of an AI system contributing to harm.
Thumbnail Image

AI Cyber Threats Shake Crypto Industry | PYMNTS.com

2026-05-15
PYMNTS.com
Why's our monitor labelling this an incident or hazard?
The event involves the use of AI systems by hackers to conduct cyberattacks on cryptocurrency platforms, leading to direct financial harm (loss of nearly $600 million), disruption of operations (shutdowns and rescues of crypto projects), and increased cybersecurity risks. The AI system's use in the attacks is a contributing factor to the harm, fulfilling the criteria for an AI Incident. Although the AI involvement is described as likely rather than definitively proven, the sophistication and speed of the attacks strongly imply AI assistance, which is sufficient for classification as an AI Incident under the framework. The harms include financial loss and disruption to critical infrastructure within the crypto ecosystem, aligning with the definitions provided.
Thumbnail Image

AI-powered crypto hacks drain $600M from DeFi as North Korea exploits surge

2026-05-15
The Next Web
Why's our monitor labelling this an incident or hazard?
The event involves AI systems explicitly used by attackers to conduct sophisticated cyberattacks on DeFi platforms, leading to direct financial harm to property and communities involved in the crypto ecosystem. The AI's role in selecting targets and designing exploits directly contributed to the realized harm of massive thefts and systemic disruption in DeFi lending protocols. Therefore, this qualifies as an AI Incident because the AI system's use directly led to significant harm (financial loss and disruption) as defined in the framework.
Thumbnail Image

Hackers armed with AI stoke fears for $130 billion crypto sector

2026-05-15
Sterling Journal-Advocate
Why's our monitor labelling this an incident or hazard?
The article explicitly states that AI was used by hackers to plan and execute crypto thefts that netted nearly $600 million, causing platform shutdowns and investor losses. The AI involvement is central to the incident, as it enabled the hackers to identify vulnerabilities and design exploits rapidly, directly leading to significant financial harm and disruption in the crypto ecosystem. This meets the definition of an AI Incident because the AI system's use directly led to harm (financial loss and disruption) and violation of property rights (the stolen crypto assets).
Thumbnail Image

Certik Issues Warning on AI Attacking Old Smart Contracts

2026-05-15
CryptoNewsZ
Why's our monitor labelling this an incident or hazard?
The article explicitly states that hackers are using AI technology to find vulnerabilities in older smart contracts, which has directly led to large-scale thefts and financial harm in the crypto sector. The involvement of AI in the use phase (exploitation) of these attacks is clear, and the resulting harm includes significant financial losses and disruption to DeFi platforms. This meets the criteria for an AI Incident as the AI system's use has directly led to harm to property and communities (financial losses and loss of trust).