Remy Blaire: September just overtook August as the worst month for crypto hacks this year, and the threat is only escalating as agentic AI powers hackers to exploit vulnerabilities at record speed.
Just recently, Bitget suffered a massive $387 million hot-wallet breach, which investigators have now tied to North Korea.
Meanwhile, platforms like NEAR Intents just dealt with a multimillion-dollar exploit, and a recent review shows tier-one code audits are missing critical threats entirely.
Well, joining us to weigh in this afternoon is Mitchell Amador, Founder and CEO of Immunefi.
Mitchell, good afternoon. Thank you so much for joining us.
Well, after a record-breaking August, new data showing that September just surpassed it with 55 major hacks and just over $760 million lost.
So why exactly is agentic AI putting Web3 security at such an extreme risk right now?
Mitchell Amador: Sure.
So the central challenge that we're facing today is the reality that frontier LLM models give every single criminal hacker organization the powers of a nation-state hacker, the ability to access the very limits, the state of the art in terms of cybersecurity capability and threat intelligence, and to deploy that at massive scale, as if they had a whole team of hackers working only for them.
So suddenly, where we were once in a world where only a few parties could afford to execute these types of difficult attacks against well-capitalized parties like exchanges, now every criminal group around the world with some sophistication and a little organization has those means and capabilities.
So I'm afraid this increase in hacks that we're seeing in August and now September is really only the beginning of what is going to become the new normal of a world under cybersecurity threat.
Remy Blaire: Yeah. So I do want to expand on this.
Immunefi identified 126 confirmed critical vulnerabilities, which is up from just 14 a year ago.
So if you're catching all these critical bugs, why are standard security audits finding a median of zero issues before deployment?
Mitchell Amador: Well, I think Charlie Munger had something insightful to say, which is, you know, tell me a man's incentives and I'll tell you the outcome of what he's going to do.
And that's really the challenge that we see with audits.
In the typical audit, these firms are paid to make the investing community, the token-purchasing community, feel safe about their contributions, to feel safe about where they're putting their money.
This has been a constant thorn in the side of security auditors in crypto.
It's the same challenge that has historically affected pen testers when we look at the rise of the traditional web and the never-ending stream of data breaches.
Now, our work at Immunefi is very different.
We're the largest security platform in on-chain finance, and our specialty is finding vulnerabilities that make it to production, that get all the way to being deployed live and in a state that is hackable.
Consequently, it is in our every interest to demonstrate only true and real vulnerabilities, and we can prove it. Okay? We can always prove it.
That is the nature of how our work with the security community works.
Now, the interesting thing about what you just noted is that jump from 14 to well over 100 in a little over a year's time.
I'll note that we're the largest on-chain security platform in the space.
We handle the vast majority of all vulnerability disclosures that happen in crypto today.
Almost every critical vulnerability in the space that is disclosed properly flows through us.
And yet we're seeing a near-tenfold increase in effective disclosures that is happening now.
That is the shape of an entirely new security landscape taking shape before our eyes, and I think that's the signal to watch as to how these markets are going to develop in the future.
Remy Blaire: Yeah. And I do want to get your take on artificial intelligence.
So the $387 million hack has been linked to North Korea.
So are state-sponsored groups now utilizing AI to automate these massive exchange heists and also launder funds cross-chain?
And where do you see this going as we look ahead?
Mitchell Amador: Sure.
And yes, state-sponsored hacking groups are now using LLM technology at massive scale.
As far as the North Koreans are concerned, they're famous for having a particular preference, which are some of these extremely effective open-source Chinese models, which they use across everything that they do.
But really, we have to keep in mind, you know, North Korea in this context is just the market leader, so to speak, in state-sponsored hacking.
There are many other groups in the world that are watching the North Korean example and building up their own capabilities.
We saw a little of that in the Iran and Israeli conflict and how there were mutual hacking attempts going on at each other's crypto exchanges.
It's really just the beginning of what is going to be a new pattern of behavior and effectively state-sponsored cyber piracy.
It's going to be everywhere.
And not only that, the security patterns that happen in crypto, where we see these types of state-sponsored piracy or cyber piracy events, is really something that we're beginning to see replicated more broadly in the traditional web and internet markets as well.
A great example of this is the compromise of various wallet backends and tax-service backends that are collecting crypto data, which are then used by scammers, phishers and cybercriminals to go and attack and attempt to cheat the holders of cryptocurrency and digital assets out of their funds.
This same phenomenon is beginning to happen at wider scale, targeting normal people in banks and with traditional financial services.
I most recently got an email from Interactive Brokers about this exact issue, and it's something that we're seeing everywhere.
Okay? What we're seeing in crypto now is going to be something that is very, very common in three to four years' time.
So yes, these cybercriminals using advanced frontier models is something that's happening everywhere and is only going to spread.
Remy Blaire: Yeah. And while I have you here, I do want to get your perspective on NEAR Intents, which was exploited for nearly $4 million due to a deposit bug, although the hacker ultimately returned the funds in under 24 hours.
But even with that return, do cross-chain bridges remain one of the biggest vulnerabilities when it comes to this new AI economy era that we live in?
Mitchell Amador: Absolutely.
Bridges remain a central target for cybercriminals around the world for the same reason that Bitget and exchanges have always remained a central target: where the funds are stored, there is opportunity, you know, for life-changing money in the eyes of many of these criminals or these institutions.
NEAR Intents was just the most recent example in a long stream of attempted bridge hacks.
Now, the positive side of this question is we have learned how to mitigate bridge damages.
$3.8 million in this type of hack is not very serious in the grand scheme of the types of attacks we've prevented over the years, and Immunefi alone has prevented several billions of dollars' worth of bridge hacks over the last few years from a great many bridges.
So $3.8 million, while obviously not the ideal case, not a happy story to be said, is proof of our maturing security stack and our security policies that create, like a ship has the ability to isolate parts of its bulkheads in order to prevent itself from sinking.
So our bridges now have the ability to isolate themselves from increasing damage by freezing very quickly, by setting up access controls in various ways, by slowing down transactions and a variety of other tools.
So this particular incident actually marks our maturing, our growing sophistication in preventing bridge hacks, even though it is, of course, a tragedy.
Remy Blaire: Yeah. And finally, Mitchell, before I let you go, with hackers out there using agents to find exploits, how does the industry move past reactive bug bounties and start stopping attacks in close to real time?
Mitchell Amador: Sure.
So the only possible solution to this is to begin to take the humans out of the loop.
Now, we at Immunefi have already been doing this over the last year.
Probably 80% to 90% of all the hackers are using automated AI stacks at this point.
We have thousands and thousands of AI systems that are trawling the code of every single one of our customers and our partners to find ways to protect it.
But unfortunately, the challenge has become human beings because human beings are not processing these vulnerabilities, they're not triaging, they're not mitigating these vulnerabilities anywhere near fast enough.
So we can go and find the solutions to people's problems. We can go and find the vulnerabilities that could lead to a theft of $1 billion, but they are not prepared to act on that information.
So this is half of the problem.
We have to bring solutions, automated mitigation solutions, that operate just as fast.
And the other side of that solution is we have to take these means that we have proven to be the best in the world.
Unquestionably, crypto bug bounties have been an incredible success in safeguarding the industry and preventing the loss of near $100 billion at this point. An incredible success.
We need to move those into the production pipeline so that all those learnings that are being created by these thousands of AI systems, these hundreds of thousands of security researchers and white-hat hackers all around the world that are doing the good job of protecting you and your money, bring those learnings, bring those discoveries, bring that AI tooling and put it into the development pipelines of companies, corporations, institutions and blockchain projects around the world.
If we can do that, these hacks will come to a permanent end within the next three to four years.
So that's the solution. And that's where we've got to go.
Remy Blaire: Okay, Mitchell.
Well, we will have to leave it there for today, but thank you so much for joining us.
And thank you so much for sharing your insights as well as your perspective.
Mitchell Amador: Thank you very much, Remy. You as well.
