AI agents can sharply cut the cost and increase the scale of attacks on cryptocurrency holders, participants at the Wyoming Blockchain Symposium said. In their view, automation will let attackers simultaneously probe wallets, passwords and networks across a large number of potential victims.
Global Settlement Network co-founder and CEO Ryan Kirkley said the industry too often views autonomous agents only as a useful tool and underestimates their use by attackers.
“We behave as if agents are always good. I think that’s a fatal mistake in almost everything related to such systems today,” he said.
According to TRM Labs, the crypto industry saw 207 hacks in the first half of 2026 — the highest for any six-month period in the firm’s data. Total losses reached $972 million.
Kirkley said that previously it was not economical for an attacker to spend significant time and resources targeting an individual with a relatively small crypto portfolio. AI agents change that math: a single autonomous system can potentially be run against many targets at once.
He suggested that in such a scenario even today’s large attacks on crypto protocols could look small compared with the combined damage from mass automated campaigns.
TRM’s data show attacks are already becoming more widespread. From January to June, their number doubled compared with 83 incidents in the same period of 2025. At the same time, infrastructure and operational compromises — including theft of private keys and seed phrases — accounted for only about 15% of incidents but roughly 76% of all losses.
Easier and faster
Web3 Foundation vice president for technical operations Bill Laboon agreed that the advantages of autonomous systems also lower the barriers for attackers.
“It means there’s less friction for the bad guys. For the good, the bad and the neutral,” he said.
The key advantage of AI agents is their ability to carry out sequences of actions on their own: gather information, call external services, work with code and use available tools without constant human involvement.
The same properties enable automated discovery of targets and vulnerabilities.
Defenders are already applying these systems. In July, the Ethereum Foundation deployed AI agents to analyze critical blockchain components. The systems reviewed code, looked for potential vulnerabilities and prepared proof-of-concept materials.
The foundation stressed the need for manual verification: a significant share of candidates flagged by the agents turned out to be false positives, duplicates or issues outside the scope of the study.
How much power to give an agent
Participants also discussed the risk of connecting autonomous systems directly to a user’s financial tools.
“The idea of giving a single agent all this power — access to my credit card data, security information, Social Security, all personal data and different accounts — looks scary without clear limits,” said Midnight Foundation president Fahmi Sayed.
Kirkley sees permission management as a solvable problem. A more serious threat, he said, is compromise of the agent itself or its runtime environment.
“Are we creating a new attack vector where an agent can be taken over and the entire wallet drained?” he asked.
This issue is growing more relevant as wallets and crypto services emerge that let AI manage assets autonomously. On August 6, MetaMask opened public access to Agent Wallet. Users can set spending limits, allowed networks, addresses and protocols for the agent, after which the system executes transactions on its own within those constraints.
MetaMask also warned about the risk of “prompt injections”. If an agent both analyzes data from external sources and can initiate financial operations, a hidden malicious instruction could lead to an irreversible on-chain transaction.
To reduce risk, the wallet separates the model’s decision-making from policy checks and transaction signing.
Other risks
Laboon pointed to another potential issue — a false sense of privacy. Even if a blockchain or application hides the content of transactions, associated metadata can allow algorithms to correlate fragments of information and reconstruct links between users.
“That’s what really worries me: metadata leaks. People will think they’re protected because they use a private network,” the Web3 Foundation representative said.
Beyond security, panelists cited lack of trust as a key barrier to wider use of AI agents. Laboon noted that current language models still generate incorrect information.
“My LLM still hallucinates sometimes. I wouldn’t want to put my retirement account in their hands,” he said.
Richard Shorten, founder of Silvermine Capital Advisors, believes the development of agent technologies is outpacing the rate at which users and companies can process the implications of their deployment. The task, he said, is to turn technical capabilities into systems people are willing to entrust with control over at least parts of a business or daily life.
Who is liable for an agent’s error
Another unresolved issue concerns legal liability for autonomous actions. Kirkley asked who should be responsible if an agent independently breaks the law, sends funds to the wrong recipient or performs an operation that cannot be reversed.
“If your agent does something illegal or spends money it shouldn’t have spent, how do you get that back? Who makes the final call? The question is where the responsibility ultimately lies,” he said.
The problem is especially acute on blockchains where, in most cases, an executed transaction cannot simply be reversed.
Earlier, Anthropic found issues of trust, lying and collusion in multi-agent AI.
In August, ForkLog examined the ‘reverse centaur’ concept described by Cory Doctorow and looked into who benefits from such automation.
