Author: Shenchao TechFlow
On October 22, 2026, Haseeb Qureshi, managing partner of the crypto investment firm Dragonfly Official Investment Firm, stated on social platform X that cybersecurity is experiencing wave-like shocks similar to the COVID-19 pandemic.
He noted that the number of on-chain hacks in the crypto space has risen sharply, but the annualized value of stolen funds remains roughly flat compared to 2025. This indicates the industry is undergoing a structural shift toward “more frequent attacks with lower individual amounts,” with smaller protocols becoming the primary targets, while larger protocols have fortified their defenses using AI-powered tools.
Coal mine canary: Why is on-chain the first testing ground for malicious cash-outs?
Haseeb defines on-chain hacks as a warning signal for internet security as a whole—the canary in the coal mine. This judgment is rooted in the fundamental difference between on-chain assets and traditional internet systems in terms of settlement mechanisms.
In traditional Web2 scenarios, even if hackers infiltrate databases or gain server access, their path to monetization remains lengthy. Attackers often need to engage in ransom negotiations, sell data on the dark web, or launder funds across banks, making it highly likely that their assets will be frozen by banks and law enforcement.
On blockchain networks, smart contracts are fully open-source and operate without permission, directly hosting highly liquid assets.
Once attackers discover a logic vulnerability, they can exploit it by injecting funds via flash loans and completing liquidation and cash-out within a single block. This frictionless and irreversible instant liquidity makes the crypto ecosystem the most sensitive proving ground for next-generation global attack tools.
Asymmetric evolution of offense and defense: AI-powered automated scanning triggers long-tail carpet bombing
The sharp increase in the number of attacks, without a proportional rise in total losses, reveals an extremely asymmetric evolution in the current offensive-defensive landscape. The primary driver behind the exponential growth in attack frequency is the widespread adoption of AI-powered automated auditing and penetration scripts.
In the past, attacks on decentralized protocols often relied on senior security experts spending weeks on manual reverse engineering, with hackers typically targeting only blue-chip protocols with hundreds of millions of dollars in locked value. For smaller protocols with only hundreds of thousands of dollars in liquidity, in-depth exploration was not cost-effective.
As large language models and automated vulnerability detection agents mature, malicious tools can conduct round-the-clock, blanket scans of all open-source contracts on the web at nearly zero marginal cost.
Small, long-tail protocols with code heavily forked from early templates, lacking daily maintenance and unable to apply patches, are rendered powerless against fully automated tools. Minor logical flaws are exploited en masse by automated scripts.
Blue-chip barrier forms: Leading defense paradigm and median loss per trade converge
In contrast to the widespread compromise of long-tail protocols, leading large protocols are rapidly widening their security advantage over attackers thanks to abundant resources.
According to historical data from Immunefi Web3 Vulnerability Bounty and Security Monitoring Platform and CertiK Smart Contract Security Audit and SkyWatch Monitoring System, after excluding isolated extreme cases of private key leaks, the median single-loss amount from conventional DeFi smart contract attacks has shown a clear trend of convergence.
The amount of losses from large-scale incidents has declined to the range of hundreds of thousands to millions of dollars, and the frequency of super-sized fund breaches exceeding $100 million has significantly decreased.
Major blue-chip protocols have generally adopted a multi-dimensional defense system, including formal verification during development, on-chain real-time monitoring of anomalous transactions, automated pause circuit breakers, and multi-million-dollar vulnerability bounty networks. In the face of automated penetration techniques, security defense has evolved into a round-the-clock battle of comprehensive computational power, leaving underfunded small and medium-sized teams rapidly behind.
Spillover effects are becoming evident: Traditional enterprises are about to face equal disruption from the internet.
Haseeb emphasized that the differentiated landscape of on-chain offense and defense—characterized by frequency multiplication, long-tail victimization, and head-end fortification—will not be confined solely to the crypto industry. As hackers refine automated attack tools on the frontlines of blockchain, the same infiltration capabilities will rapidly spread to traditional internet systems.
In the real world, traditional small and medium-sized enterprises and the long-tail software supply chain are similarly filled with millions of unpatched servers, abandoned external interfaces, and outdated databases. Once automated attack agents equipped with mature code auditing models fully shift toward the traditional internet, tens of thousands of small digital businesses lacking security teams will face saturation-level attacks.
The chain-based cyberattacks have sounded the alarm, fully revealing the reality that the cost of global cybersecurity defense is sharply rising in the AI era. For any digital organization, relying solely on reactive, patch-based approaches is no longer viable; building a defense-in-depth mechanism with automated response capabilities has become the critical turning point in resisting the wave of intelligent attacks.