Connect with us
DAPA Banner

Crypto World

AI Sparks Bug-Bounty Surge in Crypto, but Low-Quality Reports Grow

Published

on

Crypto Breaking News

Crypto security programs are rethinking vulnerability disclosure as AI tools flood bug bounty submissions across the industry. While bug bounties reward researchers for responsibly flagging flaws, the surge in AI-assisted reports is both an aid and a challenge—helping teams comb through code faster, but also increasing false positives and noise.

Industry voices say AI-assisted analysis is changing how programs must triage and verify findings, a shift with potential implications for developers, operators, and users of decentralized protocols.

Key takeaways

  • AI-enabled tooling is accelerating bug-bounty submissions, expanding both legitimate reports and noise that security teams must sort through.
  • Cosmos Labs reports a roughly 900% jump in submission volume, translating to about 20–50 reports per day and a mix of valid findings and false positives.
  • Leading researchers note rising low-quality submissions and AI-sourced noise, prompting calls for smarter triage and stricter reporting standards.
  • Industry data from HackerOne indicates 85,000 valid bounty submissions in 2025, up 7% from 2024, underscoring growing engagement in bug bounty programs.

AI-driven flood tests bug bounty programs

Co-CEO Barry Plunkett of Cosmos Labs described a dramatic change in how bug bounty programs operate. “Our program has seen a 900% increase in submission volume from last year, on the order of 20–50 per day,” he said, noting that the influx encompasses both credible vulnerability reports and a significant amount of noise. The volume surge has pushed teams to deploy more stringent triage and verification workflows to separate real threats from false alarms.

Across other organizations, developers have reported a similar pattern. Kadan Stadelmann, CTO at Komodo Platform, told Cointelegraph that bug bounty submissions and payouts have risen notably, with a noticeable uptick in low-quality reports and false positives. He suggested that AI-driven tooling may be lowering the cost of producing vulnerability submissions, thereby fueling the higher throughput.

The phenomenon isn’t isolated to crypto software. In January, Daniel Stenberg, the creator of curl—a widely used open-source tool responsible for data transfers in many blockchain infrastructures—announced he would end his personal bug bounty program due to an overwhelming tide of “AI slop in vulnerability reports,” making it exhausting to sift through submissions.

Advertisement

HackerOne, one of the largest bug bounty platforms, also highlighted the broader trend, reporting that 85,000 valid bounty submissions were filed in 2025, up 7% from the previous year. The data underscores how AI-enabled automation is reshaping the volume and pace at which researchers engage with security programs.

AI could be both the cause and the solution

Cosmos Labs has begun adapting in response to the surge by tightening its scoring framework and prioritizing trusted researchers with proven track records. Plunkett said the team is collaborating with other bug bounty providers that offer more advanced triage capabilities, aiming to separate signal from noise more efficiently as volumes rise.

Stadelmann similarly underscored the potential of defensive AI to help teams withstand the deluge. “Blockchain teams will have to create AI deterrents to sift through incoming bug bounties. The smaller the team, the bigger the problem of increased bug bounties will become. Software engineers won’t have the capacity to examine everything,” he cautioned. A defensive AI approach could automatically filter and rank reports, reducing the burden on human reviewers.

“This is where defensive AI systems to automatically sift through incoming bug bounties will be crucial. Teams dependent on bug bounties will need to develop stricter standards on their bug bounty programs as a means of lowering the number of incoming reports.”

Taken together, the episode highlights a central tension in bug bounty ecosystems: AI can amplify vigilance by widening the net for vulnerability discovery, but it can also swamp teams with untenable volumes of reports. The path forward appears to hinge on smarter triage tools, more rigorous reporter verification, and standardized quality controls across platforms.

Advertisement

What this means for developers and ecosystems

Bug bounty programs have long been a cornerstone of security for decentralized networks, offering a carrot for researchers to disclose flaws before attackers can exploit them. The current spike in AI-assisted submissions tests the sustainability of those programs, especially for teams with limited security staff. The emerging consensus among practitioners is that AI will be a necessary ally, but only if paired with robust triage protocols and tighter verification standards.

For builders and operators, the development suggests several practical shifts: invest in AI-enabled triage that can coarsely filter reports, cultivate a trusted researcher network to fast-track credible findings, and align with bounty providers that offer deeper automated review capabilities. These moves can help ensure that the bounty ecosystem remains a reliable line of defense rather than a flood of trivial or erroneous submissions.

As the industry experiments with stronger screening and smarter automation, observers will want to watch for how quickly bug bounty platforms roll out standardized quality controls and how crypto projects adapt incentive structures to maintain high signal-to-noise ratios. The degree to which smaller teams can implement effective defensive AI and whether regulators begin to steer disclosure practices will shape the resilience of crypto security in the near term.

Readers should stay tuned for updates on AI-driven triage innovations, platform policy changes, and real-world outcomes from ongoing vulnerability disclosures across leading DeFi and non-DeFi protocols.

Advertisement

Looking ahead, the balance between rapid vulnerability discovery and manageable review workloads will determine how bug bounty programs influence security in an increasingly automated landscape. The next few quarters could define whether AI remains a force multiplier for defense or becomes a bottleneck that teams must outpace with smarter tooling and stricter reporting standards.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Lazarus Group Malware Targets Crypto, Business Execs via macOS

Published

on

Lazarus Group Malware Targets Crypto, Business Execs via macOS

Security researchers have linked a new macOS malware campaign to the Lazarus Group, the North Korea-linked hacking operation behind some of the crypto industry’s biggest thefts.

Flagged on Tuesday, the new “Mach-O Man” malware kit is distributed via “ClickFix” social engineering schemes across traditional businesses and crypto companies, according to Mauro Eldritch, offensive security expert and founder of threat intelligence company BCA Ltd.

Victims are lured into a fake Zoom or Google Meet call where they are prompted to execute commands that download the malware in the background, allowing attackers to bypass traditional controls without detection to gain access to credentials and corporate systems, the security researcher said in a Tuesday report.

Researchers said the campaign can lead to account takeovers, unauthorized infrastructure access, financial losses and the exposure of critical data, underscoring how Lazarus continues to expand its targeting beyond crypto-native companies.

Advertisement

The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far. 

Fake Mach-O Man Kit apps. Source: ANY.RUN

“Mach-o Man” kit seeks to implement hidden stealer malware

The final stage of the campaign is a stealer designed to extract browser extension data, stored browser credentials, cookies, macOS Keychain entries and other sensitive information from infected devices.

Final staging director for Stealer malware. Source: Any.run

After collection, the data is archived into a zip file and exfiltrated through Telegram to the attackers. Finally, the malware’s self-deletion script removes the entire kit using the system’s rm command, which bypasses user confirmation and permissions when removing files.

The novel malware kit was reconstructed by the security expert through cloud-based malware sandbox Any.run’s macOS analysis capabilities.

Related: CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea

Earlier in April, North Korean hackers used AI-enabled social engineering schemes to steal about $100,000 worth of funds from crypto wallet Zerion, after gaining access to some team members’ logged-in sessions, credentials and the company’s private keys, Cointelegraph reported on April 15. 

Advertisement

Magazine: 53 DeFi projects infiltrated, 50M NEO tokens could be ‘given back’: Asia Express