Connect with us
DAPA Banner

Crypto World

AI floods crypto bug bounty programs with reports and false alarms

Published

on

OpenClaw enforces zero-crypto rule after scam fallout

Crypto teams are seeing a rise in bug bounty submissions as artificial intelligence tools make it easier to scan code and draft reports. 

Summary

  • Crypto teams say AI has sharply increased bug bounty submissions while false positives are rising too.
  • Cosmos Labs reported a 900% jump in submissions, forcing stricter review and triage processes.
  • Developers say defensive AI may help teams filter weak bug reports and find real threats.

At the same time, many protocols say the growing volume includes more low-quality or inaccurate findings, which is making review work harder.

Bug bounty programs reward security researchers for reporting software flaws before attackers exploit them. In crypto, these programs have become a common part of security efforts because protocols often manage large amounts of user funds and operate through open-source code.

Advertisement

Barry Plunkett, co-CEO of Cosmos Labs, said AI is changing how bug bounty programs work. He said the company’s program saw a sharp rise in volume over the past year.

“Our program has seen a 900% increase in submission volume from last year, on the order of 20-50 per day,” Plunkett noted.

He added that the rise included both valid and invalid reports, creating more work for teams trying to separate real issues from weak claims.

Kadan Stadelmann, chief technology officer at Komodo Platform, also said he has seen growth in bug bounty submissions and payouts across organizations. He said some recent reports appeared to be low quality and in some cases may have been false positives.

Advertisement

”There has definitely been an increase in low-quality bug bounty submissions, some of which have been false positives, potentially suggesting AI sourcing,” Stadelmann told Cointelegraph.

He added that AI may have lowered the cost and effort required to produce a report, leading to more submissions.

AI helps researchers but adds more noise

AI tools can help researchers review large amounts of code and point to possible vulnerabilities more quickly. That has made it easier for security researchers to join bounty programs and send findings to protocols.

However, AI systems can also generate inaccurate results. In bug bounty work, that can mean teams receive reports that sound technical but do not describe real flaws. This adds pressure on developers and security staff who must review each claim.

The wider trend is visible beyond crypto. In January, Daniel Stenberg, creator of the open-source tool curl, said he was ending his bug bounty program after dealing with what he described as an influx of ”AI slop in vulnerability reports.”

Advertisement

HackerOne, one of the largest bug bounty platforms, reported in January that it recorded 85,000 valid bounty submissions in 2025. That figure was up 7% from the previous year.

Platforms tighten review standards

As submission volumes rise, some crypto teams are changing how they run bounty programs. Plunkett said Cosmos Labs has tightened how it scores incoming reports and now gives more weight to trusted researchers with a strong record.

He also said the company is working with bug bounty providers that offer more advanced triage support. That step is meant to help reduce the time spent reviewing weak or duplicate submissions.

These changes show that teams are trying to keep bounty programs useful while managing the extra load created by AI-assisted reporting. Programs still need outside researchers, but they also need stronger filters.

Advertisement

Security teams may turn to AI for defense

Stadelmann said AI may also become part of the answer. He said smaller teams may struggle most because they have fewer engineers available to review large numbers of submissions.

”Blockchain teams will have to create AI deterrents to sift through incoming bug bounties,” He said.

He added that defensive AI systems could help sort reports and reduce the burden on internal teams.

Stadelmann also said protocols may need stricter standards for submissions to lower the number of weak reports. As AI tools spread, bug bounty programs are likely to stay active, but teams may need new processes to manage the growing flow.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Polymarket traders don’t see Kelp socializing losses after $292 million exploit

Published

on

Polymarket traders don’t see Kelp socializing losses after $292 million exploit

A Polymarket contract on whether Kelp DAO will spread the losses from the weekend’s $292 million exploit beyond those directly affected is pointing to a clear answer: probably not.

Bettors are giving a 14% chance that Kelp will “socialize the losses,” or implement a mechanism forcing rsETH holders on Ethereum, which wasn’t hit, to share the pain of users on other chains.

The attackers drained roughly 116,500 rsETH from a LayerZero-powered bridge that held the reserves backing the token across more than 20 blockchains. That left parts of the system undercollateralized, with some holders effectively owning tokens no longer fully backed by ether (ETH).

“Socializing the losses” would mean Kelp redistributes the shortfall across all rsETH holders, including those on the Ethereum mainnet, rather than leaving losses concentrated among users and protocols tied to the compromised bridge.

Advertisement

The most widely cited precedent of this approach came in 2016, when Bitfinex imposed losses on all users after a $60 million hack, effectively mutualizing the hit to avoid shutting down.

More recently, derivatives exchanges have used variations of the concept through auto-deleveraging (ADL), in which profitable positions are forcibly reduced to cover losses when insurance funds are exhausted.

During the October flash crash, ADL mechanisms were triggered across some venues, closing out even market-neutral positions and leaving traders exposed. These moves are rare and controversial, but they have been used as a last resort to stabilize systems under stress.

Kelp’s situation is more complex. The exploit drained the reserve backing rsETH across more than 20 chains, leaving losses fragmented across different user groups and platforms.

Advertisement

Holders on affected networks face impaired backing, while others remain relatively insulated. Any attempt to equalize losses would require coordination across chains, clear accounting of liabilities, and a willingness to impose losses on users who may not see themselves as affected.

That makes a clean, system-wide redistribution both technically and politically difficult, which may explain why Polymarket traders are approaching the question with skepticism.

Source link

Advertisement
Continue Reading

Crypto World

Bitcoin rally continues as Grayscale calls bull market

Published

on

Bitcoin price has formed an ascending parallel channel pattern on the daily chart.

As Bitcoin price continues to march higher towards $80,000, Grayscale researchers believe the asset has likely already formed a market bottom and is entering the early phase of a new bull cycle.

Summary

  • Bitcoin price climbed to a 10-week high above $78,000 after U.S. President Donald Trump extended the Iran ceasefire, easing geopolitical tensions.
  • Grayscale Research said on-chain data points to a market bottom, with short-term holders nearing breakeven and sell pressure declining.
  • Bitcoin futures open interest rose 5.6% to $60 billion, signaling increased bullish positioning as traders anticipate further upside.

Bitcoin (BTC) price reached a 10-week high above $78,000 on Wednesday as geopolitical tensions eased.

According to data from crypto.news, Bitcoin price rose 4.4% on April 22 to $78,251, after which it stabilized around $78,000 at the time of writing. At its present price, the token is 19% higher than its lowest point last month and 24% above its year-to-date low.

Advertisement

Bitcoin price rallied following Trump’s announcement to extend the ongoing ceasefire with Iran, as the market awaits more substantive talks to bring an end to the eight-week war that began on Feb. 24.

Despite the extension, Trump noted that the U.S. blockade on the Strait of Hormuz and Iranian ports would remain in action until Iran submits a proposal for talks to resolve the conflict permanently.

With Bitcoin trading close to a two-month high, Grayscale Research’s head of research, Zach Pandl, outlined a constructive outlook for the asset. Writing in The Stack, Pandl cited on-chain indicators showing that recent buyers are nearing breakeven following a rebound of over 20% from February lows near $63,000.

Advertisement

The realized price for coins that moved within the past one to three months now sits around $74,000. That shift suggests short-term holders have largely exited loss-making territory, which could ease selling pressure and support a change in sentiment. Pandl views the $65,000 to $70,000 range as a firm base.

While Bitcoin remains below its October 2025 peak, the current recovery mirrors early-stage behavior seen in previous upcycles.

“If Bitcoin price rises further in the coming days, more recent buyers would move into positive PnL, which can be an indicator for marking the first phase of a bull market,” Pandl said.

Data from the Bitcoin derivatives market compiled by CoinGlass seems to show that investors have already started repositioning for further gains. In the past 24 hours, total Bitcoin Futures open interest has risen by 5.6% to $60 billion. This suggests that an increasing number of investors are betting on Bitcoin to climb higher, a sentiment evident with a long/short ratio of 1.02.

Advertisement

Bitcoin price analysis

On the daily chart, Bitcoin price action has formed an ascending parallel channel pattern where it consistently carves out higher highs and higher lows. As long as Bitcoin successfully trades within the boundaries of this channel, the asset would continue to remain in an uptrend, potentially reaching $80,000 next before moving toward its previous record highs.

Bitcoin price has formed an ascending parallel channel pattern on the daily chart.
Bitcoin price has formed an ascending parallel channel pattern on the daily chart — April 22 | Source: crypto.news

The 20-day EMA has formed a bullish crossover with the 50-day EMA, which means the short-term momentum is now firmly in favor of the buyers. Meanwhile, the daily RSI shows there is still room for further gains before the market becomes overbought, allowing for more growth before experiencing any significant pullback.

Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.

Advertisement

Source link

Continue Reading

Crypto World

Claude Mythos Identifies 271 Vulnerabilities in Mozilla’s Firefox

Published

on

Claude Mythos Identifies 271 Vulnerabilities in Mozilla’s Firefox

Mozilla shipped Firefox 150 this week with patches for 271 security vulnerabilities discovered by Anthropic’s Claude Mythos Preview in an initial evaluation.

The scan forms part of Project Glasswing, Anthropic’s coordinated defense effort that grants limited Mythos access to critical infrastructure partners.

Mozilla Patches 271 Vulnerabilities After Claude Mythos Evaluation

In a recent blog post, Firefox CTO Bobby Holley explained that browser security has traditionally followed an offense-heavy model.

Under this approach, vendors acknowledged that fully eliminating exploits was unrealistic and instead focused on making attacks so costly or complex that they would not be widely abused.

Advertisement

“As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus. For a hardened target, just one such bug would have been red alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up,” Holley said.

Follow us on X to get the latest news as it happens

The executive stated that since February, the Firefox team has been working intensively with advanced AI tools to identify and remediate “latent security vulnerabilities in the browser.” 

Earlier collaboration with Anthropic, using its Opus 4.6 model, led to fixes for 22 security-sensitive issues in Firefox 148.

The latest update represents a sharp escalation in scale, roughly a twelvefold increase, highlighting how AI-driven audits are reshaping modern cybersecurity practices.

Advertisement

“Encouragingly, we also haven’t seen any bugs that couldn’t have been found by an elite human researcher,’ he added.

Why the Firefox Result Matters for Crypto

The Firefox evaluation lands as exchanges weigh their own exposure to AI-assisted attacks. Anthropic says Mythos can “identify and then exploit zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so.” 

This marks the same surface that hot wallets and decentralized applications depend on. While private keys are generally protected within wallet environments, attackers can still gain control over on-chain assets by tricking users into approving harmful transactions or exploiting compromised extensions.

Interest in such capabilities is already expanding. Coinbase has reportedly explored access to Anthropic’s Mythos. This builds on its existing use of Claude models for customer support across more than 100 regions.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Advertisement

The post Claude Mythos Identifies 271 Vulnerabilities in Mozilla’s Firefox appeared first on BeInCrypto.

Source link

Continue Reading

Crypto World

Mozilla uses Anthropic AI to uncover 271 Firefox vulnerabilities in internal test

Published

on

Mozilla uses Anthropic AI to uncover 271 Firefox vulnerabilities in internal test

Firefox developer Mozilla revealed that an early version of Anthropic’s Claude Mythos AI identified 271 vulnerabilities in the Firefox browser during internal testing, all of which were patched this week.

Summary

  • Mozilla said Anthropic’s Claude Mythos AI identified 271 vulnerabilities in Firefox during internal testing, all of which were patched this week.
  • The model showed it can scan large codebases and detect security flaws faster than traditional human-led reviews, though no findings went beyond what elite researchers could uncover.

The findings point to how advanced AI systems are starting to scan large codebases at a scale that once depended on long hours of manual work by cybersecurity researchers. Mozilla said even hardened software targets could now be examined more deeply in a shorter time.

“As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus,” Mozilla wrote. “For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up.”

Advertisement

Earlier testing using another Anthropic model had uncovered 22 security-sensitive bugs in a previous Firefox release. Despite that progress, Mozilla noted that eliminating software exploits entirely has long been considered unrealistic.

“Until now, the industry has largely fought security to a draw,” the company wrote. “Vendors of critical internet-exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe.”

Mozilla said the new system can review source code and flag weaknesses in ways that previously required highly specialized human expertise. Internal results showed the model did not uncover bugs beyond the reach of top-tier researchers.

Advertisement

“Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so,” the company said. “Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex.”

Launched in March, Claude Mythos is described by Anthropic as its most advanced model for reasoning, coding, and cybersecurity tasks, positioned above its earlier Opus series. Pre-release testing suggested it could identify thousands of unknown vulnerabilities across operating systems and browsers.

Access to the system remains limited through a restricted initiative known as Project Glasswing, which allows select firms, including Amazon, Apple, and Microsoft, to scan software for security flaws.

Security researchers warn that the same capability could be used offensively. AI tools that can analyze code at scale may also automate the discovery of exploitable bugs across widely used software systems.

Advertisement

Testing by the U.K.’s AI Security Institute showed the model could carry out complex cyber operations on its own, including completing a multi-stage corporate network attack simulation without human input. Those results have drawn attention from governments and intelligence agencies.

Despite earlier tensions with Donald Trump’s administration over the use of Anthropic’s technology, the National Security Agency has deployed Claude Mythos Preview on classified networks, according to people familiar with the matter. The move signals growing interest among U.S. agencies in AI tools that can detect critical software vulnerabilities.

Anthropic has also acknowledged that current cybersecurity benchmarks are struggling to keep pace with its latest models, raising questions about how to measure AI performance in this field.

Mozilla said the results suggest a possible turning point, where defenders may begin to narrow the long-standing gap with attackers.

Advertisement

“We are extremely proud of how our team rose to meet this challenge, and others will too,” the company wrote. 

“Our work isn’t finished, but we’ve turned the corner and can glimpse a future much better than just keeping up. Defenders finally have a chance to win, decisively.”

Source link

Advertisement
Continue Reading

Crypto World

Crypto Firms Report Flood of AI-Driven Bug Bounty Submissions

Published

on

Crypto Firms Report Flood of AI-Driven Bug Bounty Submissions

Crypto protocols have warned that an increase in AI use has led to a flood of bogus bug bounty submissions, putting a strain on teams trying to identify real threats to their protocols. 

Bug bounties are a system to reward “good” hackers for submitting reports about potential vulnerabilities and are popular in the crypto industry. AI has now made it easier to sift through large amounts of code to find possible bugs, though AI is also known to hallucinate

“AI is changing the way that bug bounty programs must operate,” said Barry Plunkett, co-CEO of Cosmos Labs, on Tuesday, responding to a bug bounty hunter who accused the protocol of ignoring their vulnerability report. 

Source: Barry Plunkett

“Our program has seen a 900% increase in submission volume from last year, on the order of 20-50 per day,” he said, adding that it’s led to a huge increase in both valid and invalid reports. 

Kadan Stadelmann, a blockchain developer and chief technology officer at Komodo Platform, told Cointelegraph he has also seen a notable increase in bug bounty submissions and payouts across organizations. 

Advertisement

“There has definitely been an increase in low-quality bug bounty submissions, some of which have been false positives, potentially suggesting AI sourcing. One potential explanation is that AI has caused a decrease in the cost to produce a report, resulting in an influx of submissions.” 

In January, Daniel Stenberg, the creator of the open-source data transfer tool curl, which is used in many apps, including blockchain infrastructure, announced he was ending his bug bounty program because of an influx of “AI slop in vulnerability reports,” and he was exhausted from sifting through them.

The creator of the open-source data transfer tool curl said he has received an influx of bug bounty submissions. Source: Daniel Stenberg

HackerOne, one of the largest bug bounty platforms in the world, reported in January that there were 85,000 valid bounty submissions in 2025, up 7% from the previous year.

AI could be both the cause and the solution

Plunkett said Cosmos Labs has already started to adapt its approach as a result of the uptick in bug bounty submissions by tightening how it scores submissions, prioritizing trusted researchers with a proven track record and working with other bug bounty providers that offer more advanced triage.

Meanwhile, Stadelmann said bug bounty programs have proven integral to defending decentralized systems, and adopting AI to assist in sifting through the noise could be a solution.

“Blockchain teams will have to create AI deterrents to sift through incoming bug bounties. The smaller the team, the bigger the problem of increased bug bounties will become. Software engineers won’t have the capacity to examine everything,” he said.

Advertisement

“This is where defensive AI systems to automatically sift through incoming bug bounties will be crucial. Teams dependent on bug bounties will need to develop stricter standards on their bug bounty programs as a means of lowering the number of incoming reports.”

Related: Crypto hackers stole $17B over past 10 years: DefiLlama