CoinDesk
OpenZeppelin CEO Manuel Aráoz warned on Wednesday that he now considers "all" of decentralized finance unsafe, arguing that AI coding agents have become "superhuman" at finding vulnerabilities in smart contracts. The warning lands as DeFi's total value locked has dropped more than $20 billion year-to-date and DeFiLlama-tracked losses to hacks have crossed $1.1 billion over the past 12 months — including April's $292 million Kelp DAO exploit and the $27 million Step Finance breach that forced the Solana-based project to shut down.
Why it matters
Aráoz's argument rests on a long-standing asymmetry in smart contract security: defenders have to fix every bug, attackers need to find just one. Coding agents, he wrote on X, have tilted that balance decisively toward attackers. His warning lands alongside Anthropic's disclosure that its restricted Claude Mythos model can autonomously discover software vulnerabilities and develop working exploits at a level the company says surpasses existing automated tools. A class of attackers that operates at machine speed, scanning publicly readable on-chain code for weaknesses, changes the threat model that DeFi was designed around — one built for humans working at human speed.
Market impact
The macro picture reinforces the warning. DeFi's $20 billion-plus TVL contraction this year is partly a price story, but the steady cadence of high-profile exploits keeps pulling liquidity out of the sector on its own. The Kelp DAO breach showed how a vulnerability in cross-chain infrastructure can spill into the broader ecosystem within hours, while Step Finance's shutdown demonstrated that mid-sized protocols have little margin to absorb a single major hit. For now, the practical question for protocols is whether defender-side tooling — formal verification, on-chain monitoring, automated patching — can be deployed at the same cadence as the attacker-side agents Aráoz is flagging.
Frequently asked questions
-
Who is Manuel Aráoz and why does his warning carry weight?
Aráoz is the CEO of OpenZeppelin, one of the most widely used smart contract security firms in crypto, whose libraries secure a large share of deployed DeFi code. His warning that he now considers all of DeFi unsafe is significant because it comes from inside the defender camp, not from an outside critic.
-
How much has DeFi lost to hacks in the past 12 months?
DeFiLlama data cited in the report shows more than $1.1 billion lost to DeFi hacks over the trailing 12 months. That includes April's $292 million Kelp DAO exploit and the $27 million Step Finance breach that forced the Solana-based project to shut down.
-
What is Claude Mythos and how does it relate to the warning?
Claude Mythos is a restricted AI model from Anthropic that the company says can autonomously discover software vulnerabilities and develop working exploits at a level surpassing existing automated tools. Aráoz's warning about AI coding agents landing on the same week as that disclosure is what makes the asymmetry…
-
Why is smart contract security described as asymmetric?
Defenders must fix every vulnerability in a protocol's code to keep it safe, while attackers only need to find a single exploitable bug to drain funds. Aráoz's argument is that AI coding agents are tipping that balance further toward attackers by finding bugs faster than humans can patch them.
-
How much has DeFi's total value locked fallen this year?
DeFiLlama data shows DeFi's total value locked has dropped more than $20 billion since the start of 2026. Part of that reflects broader crypto price weakness, but a steady cadence of high-profile exploits has also pulled liquidity out of the sector on its own.
Lookonchain
WuBlockchain
CryptoSlate
TheBlock
CoinTelegraph