📰 Key Takeaways

Phemex CEO Federico Variola says AI has been a “net negative” for the crypto industry overall, even though his exchange announced back in February that it would fully integrate AI into product development and internal operations. He points out that AI has already pulled significant capital and liquidity out of crypto, while also massively boosting attackers’ capabilities — social engineering tactics and vulnerability-hunting efficiency have both gotten a serious upgrade thanks to AI. Variola specifically pointed to an incident this past July: hackers exploited a vulnerability in the Coldcard hardware wallet to steal roughly $116 million in Bitcoin from over 5,200 addresses, and that vulnerability is widely believed to have been discovered through malicious use of AI. Coinkite CEO Rodolfo Novak warned developers at the time that AI-assisted code review can now dig up vulnerabilities that even the industry’s most senior experts might miss — a reality the industry has to reckon with. Variola also warned that small and mid-sized protocol teams without huge security budgets will struggle to survive in the AI era, and that this pressure could end up pushing the crypto industry toward more centralization rather than decentralization, since many of the fixes for AI threats are essentially centralization by another name. He also noted that as AI threats become more common — whether it’s device hacks or a rise in social engineering attacks — regular retail users will be increasingly scared off from self-custody and DeFi, since there’s a lot more risk to worry about than before. That said, he did acknowledge AI agents have real value in certain applications — see the original article for more.

💬 JudyAI Lab Take

According to Phemex CEO Variola’s observations, AI hasn’t been an unqualified boost for crypto — it’s actually pulling capital and liquidity out of the industry while simultaneously arming attackers.

The Coldcard hardware wallet hack, which cost victims $116 million, points to a trend every AI builder should take seriously: AI-assisted code review and vulnerability hunting have gotten strong enough to catch issues that even senior experts might overlook, meaning the capability gap between attackers and defenders is being amplified by AI. For small and mid-sized teams, if you don’t have the security budget to match this level of automated auditing and attack sophistication, you’re going to fall behind fast — and that could end up forcing the entire industry toward centralization instead of the decentralization it was originally built for, since a lot of these mitigation strategies basically just hand the risk over to better-resourced centralized players.

Worth thinking about for every AI builder: should you be using AI to re-audit your own project’s code and security assumptions right now, instead of waiting for someone else to find the hole first?

📅 Source Info

🔗 Further Reading