Crypto asset management company Matrixport stated in its latest research note that cryptocurrency markets are approaching a critical turning point, according to a report released by the firm.

A purpose-built AI security agent detected vulnerabilities in 92% of exploited DeFi smart contracts in a new open-source benchmark.

The study, released Thursday by AI security firm Cecuro, evaluated 90 real-world smart contracts exploited between October 2024 and early 2026, representing $228 million in verified losses. The specialized system flagged vulnerabilities tied to $96.8 million in exploit value, compared with just 34% detection and $7.5 million in coverage from a baseline GPT-5.1-based coding agent.

Both systems ran on the same frontier model. The difference, according to the report, was the application layer: domain-specific methodology, structured review phases and DeFi-focused security heuristics layered on top of the model.

The findings arrive amid growing concern that AI is accelerating crypto crime. Separate research from Anthropic and OpenAI has shown that AI agents can now execute end-to-end exploits on most known vulnerable smart contracts, with exploit capability reportedly doubling roughly every 1.3 months. The average cost of an AI-powered exploit attempt is about $1.22 per contract, sharply lowering the barrier to large-scale scanning.

Previous CoinDesk coverage outlined how bad actors such as North Korea have begun using AI to scale hacking operations and automate parts of the exploit process, underscoring the widening gap between offensive and defensive capabilities.

Cecuro argues that many teams rely on general-purpose AI tools or one-off audits for security, an approach the benchmark suggests may miss high-value, complex vulnerabilities. Several contracts in the dataset had previously undergone professional audits before being exploited.

The benchmark dataset, evaluation framework and baseline agent have been open-sourced on GitHub. The company said it has not released its full security agent due to concerns that similar tooling could be repurposed for offensive use.

Ethereum has spent years trying to fix high fees, and recent upgrades finally made transactions cheaper. But while they solved one problem, they may have opened the door to another.

Leon Waidmann, head of research at Lisk, noted in an X post on Wednesday, Feb. 18, that network activity is booming, with stablecoin volume hitting $7.5 trillion in a single quarter while transaction fees stayed under a dollar.

“Record usage. Record cheap. At the same time. The biggest divergence between fundamentals and price in all of crypto right now,” he noted.

But the growth may hide a more alarming reality. A recent study by blockchain researcher Andrey Sergeenkov finds address poisoning attacks surged significantly after the December Fusaka upgrade, which cut gas fees sixfold and made spam attacks cheap enough to scale.

Address poisoning works by sending tiny transfers from addresses that look like the victim’s real contacts. If the victim copies the wrong address from their history, funds get stolen. Sergeenkov says attackers treat this like a lottery, sending millions of cheap transactions in the hope of a few big payoffs.

Unintended Consequences

Before Fusaka, attackers were sending roughly 30,000 dust transactions per day, according to Sergeenkov’s analysis of 101 tokens between Sept. 1, 2025, and Feb. 13 this year.

But after the upgrade, lower fees made mass poisoning viable in a way that wasn’t possible before, and daily dust transactions jumped to 167,000, peaking at about 510,000 in one day in January.

In just over two months after Fusaka, victims lost more than $63 million, 13 times the $4.9 million lost in a comparable prior period, the data shows.

“There is nothing wrong with lowering fees, but the security problems that cheap transactions amplify should have been addressed before the upgrade. When the Ethereum Foundation claims it is building trillion-dollar security, user safety must be the strictest priority over growth metrics,” Sergeenkov writes.

Sergeenkov noted that a single transfer accounted for a large share of the post-Fusaka losses, when attackers stole $50 million in USDT on Dec. 19, 2025. Even leaving that out, total losses still came to $13.3 million, 2.7 times higher than the pre-Fusaka period, he concluded.