Bug Bounties Hit Limits as AI Puts Crypto Hackers on Equal Footing

AI has handed crypto attackers the identical instruments defenders use, and the outcomes are costing the business billions, consultants say.

Mitchell Amador, CEO of Immunefi, informed Decrypt in the course of the begin of Token2049 week in Singapore that AI has turned vulnerability discovery into near-instant exploitation, and that the superior auditing instruments his agency constructed are not unique to the nice guys.

“If we’ve that, can the North Korean Lazarus group construct related tooling? Can Russian Ukrainian hacker teams construct related such tooling?” Amador requested. “The reply is that they’ll.”



Immunefi’s AI auditing agent outperforms the overwhelming majority of conventional auditing companies, however that very same functionality is inside attain of well-funded hacking operations, he stated.

“Audits are nice, but it surely’s nowhere close to sufficient to maintain up with the speed of innovation and the speed of the compounding enchancment of the attackers,” he stated.

With over 3% of whole worth locked stolen throughout the ecosystem in 2024, Amador stated that whereas safety is not an afterthought, tasks “battle to know learn how to make investments and learn how to allocate sources there successfully.” 

The business has moved from “a prioritization drawback, which is a superb factor, into it being a data and academic drawback,” he added.

AI has additionally made subtle social engineering assaults grime low-cost, based on Amador. 

“How a lot do you assume that telephone name prices?” he stated, referring to AI-generated phishing calls that may impersonate colleagues with disturbing accuracy. “You possibly can execute that for pennies with a well-thought-out system of prompts, and you may execute these en mass. That’s the scary a part of AI.”

The Immunefi CEO stated teams akin to Lazarus seemingly make use of “a minimum of a couple of hundred guys, if not most likely low hundreds working across the clock” on crypto exploits as a serious income supply for North Korea’s economic system. 

“The aggressive pressures stemming from North Korea’s annual income quotas” drive operatives to guard particular person belongings and “outperform colleagues” moderately than coordinate safety enhancements, a current SentinelLABS intelligence report discovered.

“The sport with AI-driven assaults is that it hurries up the speed at which one thing can go from discovery to take advantage of,” Amador informed Decrypt. “To defend in opposition to that, the one resolution is even quicker countermeasures.”

Immunefi’s response has been to embed AI straight into builders’ GitHub repositories and CI/CD pipelines, catching vulnerabilities earlier than code reaches manufacturing, he famous, whereas predicting this method will set off a “precipitous drop” in DeFi hacks inside one to 2 years, probably lowering incidents by one other order of magnitude.

Dmytro Matviiv, CEO of Web3 bug bounty platform HackenProof, informed Decrypt that “handbook audits will all the time have a spot, however their position will shift.”“AI instruments are more and more efficient at catching ‘low-hanging fruit’ vulnerabilities, which reduces the necessity for large-scale handbook opinions of frequent errors,” he stated. “What stays are the refined, context-dependent points that require deep human experience.”

To defend in opposition to AI-powered assaults, Immunefi has applied a whitelist-only coverage for all firm sources and infrastructure, which Amador stated has “arrested hundreds of those tried spear phishing strategies very successfully.” 

However this stage of vigilance is not sensible for many organizations, he stated, noting “we are able to do this at Immuneify as a result of we’re an organization that lives and breathes safety and vigilance. Regular folks cannot do this. They’ve lives to dwell.”

Bug bounties hit a wall

Immunefi has facilitated over $100 million in payouts to white-hat hackers, with regular month-to-month distributions starting from $1 million to $5 million. Nonetheless, Amador informed Decrypt that the platform has “hit the bounds” as there aren’t “sufficient eyeballs” to supply the required protection throughout the business.

The constraint is not nearly researcher availability, as bug bounties face an intrinsic zero-sum recreation drawback that creates perverse incentives for each side, based on Amador. 

Researchers should reveal vulnerabilities to show they exist, however they lose all leverage as soon as disclosed. Immunefi mitigates this by negotiating complete contracts that specify every thing earlier than disclosure happens, Amador stated.

In the meantime, Matviiv informed Decrypt that he does not assume “we’re wherever near exhausting the worldwide pool of safety expertise,” noting that new researchers be a part of platforms yearly and progress shortly from “easy findings to extremely complicated vulnerabilities.”

“The problem is making the house engaging sufficient when it comes to incentives and neighborhood for these new faces to stay round.”

Bug bounties have seemingly reached their “zenith in effectivity” exterior of net-new improvements that do not even exist in conventional bug bounty packages, Amador added. 

The corporate is exploring hybrid AI options to offer particular person researchers better leverage to audit extra protocols at scale, however these stay in R&D.

Bug bounties stay important as “a various, exterior neighborhood will all the time be finest positioned to find edge circumstances that automated methods or in-house groups miss,” Matviiv famous, however they will more and more work alongside AI-powered scanning, monitoring, and audits in “hybrid fashions.”

The largest hacks aren’t coming from code

Whereas sensible contract audits and bug bounties have matured significantly, probably the most devastating exploits are more and more bypassing code completely. 

The $1.4 billion Bybit hack earlier this yr highlighted this shift, Amador stated, with attackers compromising Secure’s front-end infrastructure to exchange authentic multi-sig transactions moderately than exploiting any sensible contract vulnerability.

“That wasn’t one thing that might have been caught with an audit or bug bounty,” he stated. “That was a compromised inside infrastructure system.”

Regardless of safety enhancements in conventional areas like audits, CI/CD pipelines, and bug bounties, Amador famous that the business is “not doing so scorching” on multi-sig safety, spear phishing, anti-scam measures, and neighborhood safety.

Immunefi has launched a multi-sig safety product that assigns elite white-hat hackers to manually assessment each vital transaction earlier than execution, which it stated would have caught the Bybit assault. However he acknowledged it is a reactive measure moderately than a preventative one.

This uneven progress explains why 2024 turned the worst yr for hacks regardless of enhancements in code safety, as hack patterns observe a predictable mathematical distribution, making single giant incidents inevitable moderately than anomalous, Amador stated. 

“There’s all the time going to be one large outlier,” he stated. “And it is not an outlier, it is the sample. There’s all the time one large hack per yr.”

Good contract safety has matured significantly, Matviiv stated, however “the following frontier is unquestionably across the broader assault floor: multi-sig pockets configurations, key administration, phishing, governance assaults, and ecosystem-level exploits.”

Efficient safety requires catching vulnerabilities as early as doable within the improvement course of, Amador informed Decrypt. 

“Bug bounty is the second costliest, the costliest being the hack,” he stated, describing a hierarchy of prices that will increase dramatically at every stage.

“We’re catching bugs earlier than they hit manufacturing, earlier than they even hit an audit,” Amador added. “It will by no means even be included in an audit. They would not waste their time with it.”

Whereas hack severity stays excessive, Amador stated that “the incidence price goes down, and the extent of severity of many of the bugs goes down, and we’re catching increasingly more of these items within the earlier phases of the cycle.”

When requested what single safety measure each mission at Token2049 ought to undertake, Amador known as for a “Unified Safety Platform,” addressing a number of assault vectors.

That’s important, as fragmented safety basically forces tasks to “do the analysis your self” on merchandise, limitations, and workflows, he stated. 

“We’re not but to the purpose the place we are able to deal with trillions and trillions of belongings. We’re simply not fairly there at prime time.”