CryptoSlate
OpenAI unveiled a cybersecurity initiative called Daybreak on May 11, designed to find, validate, and help fix software vulnerabilities before attackers reach them. The company frames the approach as making software "resilient by design," pushing security earlier into the build cycle through AI-assisted code review, threat modeling, patch validation, and dependency analysis. The logic lands hard in crypto, where a software failure inside a single block becomes an immediate capital loss.
Why it matters
TRM Labs' 2026 Crypto Crime Report puts the scale in stark terms: illicit actors stole $2.87 billion across nearly 150 hacks and exploits in 2025. Infrastructure attacks — compromised keys, wallet infrastructure, privileged access, front-end surfaces, and control planes — drove $2.2 billion of that total. Code exploits, the category most pre-launch audits directly address, accounted for $350 million, or 12.1%. Hacken's Q1 2026 data reinforces the gap: Web3 lost $482 million across 44 incidents in a single quarter, and six of those involved audited protocols, including one that had received 18 separate audits. A $282 million theft in that period involved no code exploit at all — the attacker bypassed the contract layer and compromised the operational and social infrastructure around it. CertiK's latest wrench-attack data adds another dimension: 34 verified physical-coercion incidents occurred globally between January and April 2026, up 41% year-over-year, with estimated losses around $101 million over those four months and a projected full-year count near 130.
Market impact
The pattern reframes the threat surface. Audits are point-in-time reviews of contract code; the actual money is now leaving through multisig signers, custody systems, front-end deployments, oracle dependencies, and the people holding privileged credentials. The Daybreak model — AI-assisted code review running continuously, threat modeling across every protocol upgrade, dependency and oracle risk analysis, patch validation before governance execution, regular privileged-access review, and monitoring that catches abnormal behavior before funds move — maps directly onto the layers where the 2025 losses actually occurred. The bull case is that "resilient by design" becomes a competitive standard, giving protocols that can demonstrate continuous operational resilience a clearer path to insurance, regulatory standing, and institutional capital.
Frequently asked questions
-
What is OpenAI's Daybreak cybersecurity initiative?
Daybreak is a security initiative OpenAI introduced on May 11, designed to find, validate, and help fix software vulnerabilities before attackers can exploit them — using AI-assisted code review, threat modeling, patch validation, and dependency analysis earlier in the build cycle.
-
How much crypto was stolen in 2025, and where did the losses come from?
TRM Labs' 2026 Crypto Crime Report tallied $2.87 billion stolen across nearly 150 hacks and exploits in 2025. Infrastructure attacks drove $2.2 billion, while code exploits — the category most audits cover directly — accounted for $350 million, or 12.1%.
-
Why are audits alone no longer enough for crypto security?
Hacken's Q1 2026 data shows Web3 lost $482 million across 44 incidents in a single quarter, and six of those involved audited protocols, including one with 18 separate audits. A $282 million theft in that quarter involved no code exploit — the attacker bypassed the contract layer entirely and compromised the…
-
What does "resilient by design" mean for crypto protocols?
Translated to crypto, it means continuous AI-assisted code review, threat modeling on every protocol upgrade, dependency and oracle risk analysis, patch validation before governance execution, regular privileged-access review across multisigs and custody systems, and monitoring that catches abnormal behavior before…
-
Could AI-assisted security backfire for the crypto industry?
Yes. OpenAI itself flagged the dual-use risk, noting the same AI capabilities that help defenders review code and validate patches can help attackers scale phishing, clone legitimate front ends, and run social engineering against signers and support channels. Hacken and CertiK data both show social and operational…
WuBlockchain
TheBlock
WatcherGuru
Benjamin Cowen
CoinDesk
Crypto News
CoinTelegraph