Skip to main content

133 posts tagged with "Security"

Cybersecurity, smart contract audits, and best practices

View all tags

Bitcoin's Quantum Bifurcation: 6.7M BTC Vulnerable and Two Allocator Camps

· 14 min read
Dora Noda
Dora Noda
Software Engineer

Roughly 6.7 million BTC sit in addresses that have already broadcast their public keys to the world. That is about a third of the total supply, including the ~1.1 million coins attributed to Satoshi Nakamoto. A sufficiently capable quantum computer could, in principle, derive the private key for any of them.

Two of the most-cited research desks in crypto have looked at exactly the same data and reached opposite conclusions about what allocators should do this year.

Capriole Investments founder Charles Edwards argues the community must ship a quantum fix by the end of 2026 or absorb a 20% valuation discount, with downside below $50,000 by 2028 if the network drags its feet. Grayscale Research, in its 2026 Digital Asset Outlook: Dawn of the Institutional Era, calls quantum risk a "red herring" — real but distant, unlikely to move 2026 prices, and overshadowed by the institutional capital wave reshaping the asset class.

This isn't a debate about whether the threat is real. Both camps agree it is. It's a debate about when the cost shows up in the price — and that question now drives two completely different allocation playbooks.

The Number Everyone Is Arguing About: 6.7 Million BTC​

Quantum vulnerability in Bitcoin is not uniform. The danger depends on what kind of address holds your coins, and whether their public key has ever appeared on-chain.

The breakdown that anchors most of the 2026 discourse looks roughly like this:

  • ~1.72 million BTC in Pay-to-Public-Key (P2PK) outputs. These are the original 2009-era addresses, including the bulk of Satoshi's stash. P2PK exposes the public key directly. There is no recipient to migrate the coins to a quantum-safe address — many of these holders are believed to be dead or to have lost their keys.
  • ~4.9 million BTC in reused addresses across other formats. Once you spend from a Pay-to-Public-Key-Hash (P2PKH), Pay-to-Witness-Public-Key-Hash (P2WPKH), or Taproot output, the public key is visible in the witness data. If the holder reuses that address — or leaves a balance behind after first spend — the public key is exposed for the rest of the network's history.
  • ~200,000 BTC scattered across other reused or partially exposed categories.

Add it up: roughly 6.8 million BTC, or about 34% of the circulating supply, lives in addresses that a Shor-capable quantum computer could, in theory, drain. The remaining two-thirds — sitting in unspent P2PKH/P2WPKH/Taproot outputs whose public keys have never been broadcast — are protected by an additional layer of hashing that quantum computers cannot break with the same algorithm.

That asymmetry is what makes the debate so structurally weird. Quantum risk in Bitcoin is not "the network breaks." It is "early adopters and sloppy address-reusers get drained, while careful single-use HODLers are fine." The market has to price a threat that is concentrated in a specific cohort of coins, not spread evenly across the supply.

Edwards' Case: Price the Risk Now, Ship the Fix Faster​

Charles Edwards has been the loudest institutional voice on the bear side of the quantum debate. His thesis, articulated across a series of late-2025 and 2026 talks, has three parts.

First, the discount is already there. Edwards argues that if you took an honest discounted-cash-flow style approach to Bitcoin's "stock" of vulnerable supply versus its "flow" of new issuance, the asset already deserves a markdown of roughly 20% relative to where it would trade if quantum risk were zero. In his framing, every month the network goes without a clear quantum-resistant migration path, that discount widens.

Second, the timeline is shorter than people think. Edwards leans on Deloitte's analysis estimating ~25% of BTC is exposed, and stitches it to the rapid progression of public quantum hardware. Project Eleven's Q-Day Prize — awarded April 24, 2026 to researcher Giancarlo Lelli for breaking a 15-bit elliptic curve key on a publicly accessible quantum computer — is the data point he keeps returning to. Steve Tippeconnic's 6-bit demonstration in September 2025 was the first public break; Lelli's 15-bit result is a 512x improvement in seven months. The exponential is not theoretical.

Third, banks won't save Bitcoin. Edwards' more pointed argument is that Bitcoin will be hit before traditional finance because banks have already begun migrating to post-quantum encryption schemes — and even when banks fail, they have legal mechanisms to claw back fraudulent transfers. Bitcoin has no such mechanism. A successful quantum drain on a Satoshi-era P2PK address would be irreversible, public, and existentially confidence-shattering for the asset.

His prescribed action: ship a quantum-resistant migration path before the end of 2026. If Bitcoin doesn't, Edwards' worst-case scenario for 2028 puts BTC below $50,000 — not because quantum computers will actually break ECDSA by then, but because the expectation of an unfixable cliff will be priced in well before the cliff arrives.

Grayscale's Case: Real, But Not for 2026​

Grayscale's 2026 Digital Asset Outlook takes the opposite stance. Quantum computing is acknowledged as a long-term consideration, but the firm's framing is unambiguous: it is a "red herring" for 2026 markets.

The Grayscale argument rests on three load-bearing claims.

One: the hardware isn't there. A sufficiently powerful quantum computer to derive private keys from public keys is not expected before 2030 at the earliest. Google's own published whitepapers in April 2026 estimated that a 256-bit ECC attack would require under 500,000 physical qubits — and Willow, Google's flagship chip from late 2024, has 105. A subsequent Caltech and Oratomic paper brought the requirement as low as ~10,000 qubits in a neutral-atom architecture, but even that is roughly two orders of magnitude beyond what any public quantum system has demonstrated.

Two: developer response is real. BIP-360, which introduces Pay-to-Merkle-Root (P2MR) — a new Bitcoin output type that uses Dilithium (now NIST-standardized as ML-DSA) post-quantum signatures and hides public keys from quantum attack — was merged into Bitcoin's official BIP repository on February 11, 2026. BTQ Technologies released the first working testnet implementation (v0.3.0) the following month. The migration runway exists; it just hasn't activated.

Three: 2026 catalysts dominate. Grayscale's outlook frames 2026 as the start of "the institutional era." Spot ETF AUM has crossed $87 billion. The CLARITY Act is on a May Senate Banking markup track. SEC Chair Paul Atkins has shipped a four-category token taxonomy that opens institutional-grade flow into the asset class. Against that backdrop, Grayscale argues, a 2030+ tail risk is the wrong thing to underweight on.

The implicit allocator instruction is "stay long, ignore the noise." Grayscale's position is not that quantum risk is fake — the firm explicitly notes Bitcoin and most blockchains will eventually need post-quantum upgrades. The position is that 2026's price discovery will be driven by ETF flows, regulatory clarity, and macro liquidity, not by hypothetical 2030 hardware.

The Two Allocator Playbooks​

Boil the camps down to operating instructions and the divergence becomes stark.

Edwards-camp playbook (defensive):

  • Front-load migration tooling reviews now. Custodians stress-test BIP-360 wallets on testnet. Cold-storage providers publish post-quantum migration roadmaps before EOY 2026.
  • Pre-emptively re-spend exposed cold-storage UTXOs into fresh single-use addresses to bury public keys back behind hashes.
  • Pay the real cost today — operational complexity, audit overhead, possibly fee spikes during a coordinated migration window — to avoid catastrophic tail risk in 2028-2030.
  • Treat any 2026 BTC weakness as partially attributable to quantum-overhang, not just macro.

Grayscale-camp playbook (opportunistic):

  • Continue sizing BTC against ETF flow models, regulatory catalysts, and four-year-cycle decoupling theses.
  • Assume orderly, EF-style protocol upgrade cadence resolves the migration during the 2027-2030 window.
  • Don't pay up for "quantum-resistant infrastructure" exposure today; the multiples don't justify it on 2026 cash flows.
  • Keep an eye on quantum hardware milestones, but treat them as monitoring, not allocation, signals.

Neither playbook is unreasonable on its own terms. The split exists because the two camps disagree on the asymmetry — specifically, whether the cost of frontloaded defense is small relative to the payoff if Edwards is right, or large relative to the payoff if Grayscale is right.

The Governance Question Both Camps Are Avoiding​

The most uncomfortable part of the 2026 quantum debate isn't the hardware timeline. It is the governance question raised by BIP-361.

On April 15, 2026, Jameson Lopp and five co-authors published BIP-361 — "Post Quantum Migration and Legacy Signature Sunset" — a proposal that would, after activation through a soft fork, force a deadline on quantum-vulnerable address holders. Phase A (~160,000 blocks, roughly three years post-activation) stops the network from accepting new sends to vulnerable legacy address types. Phase B (another ~two years later) rejects any transaction signed with legacy ECDSA or Schnorr from those addresses. Funds in unmigrated wallets become effectively frozen.

The technical case is straightforward: if you don't sunset legacy signatures, a single quantum drain can confidence-shock the entire network. The political case is brutal. "Whoever holds the keys controls the coins — without exception" has been a load-bearing Bitcoin promise since 2009. BIP-361 puts an expiry date on that promise.

Adam Back's counterproposal — articulated at Paris Blockchain Week — is that quantum-resistant features should be added as optional upgrades, not forced freezes. Current quantum computers, Back has said publicly, "remain essentially lab experiments," and a forced sunset of dormant holdings (most prominently Satoshi's) would set a precedent that overrides Bitcoin's core property-rights guarantee.

Across developer forums and X, BIP-361 has been called "authoritarian" and "predatory" by critics who argue that the proposal — even if technically necessary — undermines the asset's most marketable property to institutional buyers: that no one, not even the developers, can take your coins.

This is the part of the debate Edwards and Grayscale don't directly address. Edwards' camp wants a fix; BIP-361 is the most concrete fix on the table; but BIP-361 is also the policy choice most likely to fracture the Bitcoin community along ideological lines and produce a contentious fork. Grayscale's camp wants to wait; but waiting compresses the runway for any soft-fork debate to play out before the threat materializes.

The Read-Through for Infrastructure​

Whichever camp is right, the migration runway is going to produce a measurable workload signature for blockchain infrastructure providers. Quantum-resistance testing and pre-emptive migration are not the same RPC traffic shape as DeFi memecoin spam.

Custodian-grade migration testing tends to generate:

  • Heavy archive-node reads — full UTXO scans to identify exposed public keys across an institutional book.
  • Sustained signature-scheme attestation traffic — verifying that newly-deployed P2MR outputs validate correctly under both legacy and post-quantum verifiers.
  • Bulk address-format scans — institutional wallets running batch checks on which UTXOs sit in vulnerable formats.
  • Long-running trace queries on settlement events — the kind of debug-level workload that mainstream commodity RPC providers are not optimized for.

This is workload that lands on the Edwards-camp side first. Grayscale-camp allocators won't generate it until they have to. So the early signal that quantum migration is becoming operational, not theoretical, will show up as a shift in custodian RPC traffic patterns long before it shows up in BTC spot price.

BlockEden.xyz operates institutional-grade RPC and indexer infrastructure across Bitcoin, Sui, Aptos, Ethereum, and 25+ other chains — including the archive-node and trace workloads that quantum-migration testing tends to generate. If your team is stress-testing post-quantum tooling on Bitcoin or any other asset, explore our API marketplace for infrastructure built for non-trivial workloads.

What to Watch Through End of 2026​

The Edwards-versus-Grayscale split is a real allocator disagreement, but it will be resolved one way or the other by a small handful of milestones over the next eight months.

Quantum hardware: Watch for the next Q-Day Prize award. A 20-bit or 24-bit ECC break on public hardware would make the exponential too obvious to ignore. Conversely, no further public progress through end of 2026 lengthens Grayscale's runway.

BIP-361 activation path: Does the proposal pick up enough developer support to enter a real activation discussion, or does Adam Back's optional-upgrades counter-proposal carry the room? Either outcome materially shifts the migration timeline.

Custodian behavior: Coinbase Custody, BitGo, Anchorage, and Fidelity Digital Assets all publish (or don't publish) post-quantum readiness statements. The first major custodian to commit to BIP-360 wallets in production is the leading indicator that Edwards' urgency is bleeding into operational decisions.

Spot price reaction: If BTC underperforms its ETF-flow model in 2026 by more than ~15%, Edwards' "quantum discount" framing gets harder to dismiss. If BTC matches or exceeds Grayscale's first-half all-time-high projection, the red-herring framing wins by default.

The asymmetry to watch is this: Edwards needs to be right eventually for his case to land, even if 2026 prices don't reflect it. Grayscale needs to be right now — every month BTC marches higher without an obvious quantum overhang strengthens the red-herring frame, but a single confidence-shock event could erase years of that thesis in a week.

That's the bifurcation. Two desks, the same data, opposite playbooks. The market will pick a side before the quantum computers do.

Sources​

Drift Drops Circle: The $148M Bailout That Rewrote DeFi's Stablecoin Trust Playbook

· 12 min read
Dora Noda
Dora Noda
Software Engineer

For three years, the "USDC vs USDT" debate inside DeFi was about liquidity depth, fee tiers, and which bridge had the cleanest cross-chain rails. Then on April 16, 2026, a single Solana protocol turned it into a question about freeze policy — and the answer flipped a stablecoin's regulatory ambiguity from a liability into a feature.

Drift Protocol, fresh off a $285 million exploit on April 1 that drained more than half its TVL in roughly twelve minutes, announced it would relaunch as a USDT-settled perpetuals exchange. Tether and a handful of market-making partners committed up to $148 million to stand up a recovery pool for users. Circle, the issuer of the USDC that had been Drift's primary settlement asset for years, was conspicuously absent from the rescue — and from the freeze actions critics had hoped would claw back the stolen funds.

That single switch did more to reshape the competitive landscape between Circle and Tether than two years of compliance maneuvering around the GENIUS Act. Here is why.

Twelve Minutes That Cost $285 Million​

The April 1 attack on Drift was not a smart-contract bug. It was a six-month social-engineering campaign that blockchain forensics firms Elliptic and TRM Labs have publicly attributed to North Korea's Lazarus Group, also tracked as UNC4736 or TraderTraitor.

According to Drift's own post-mortem and Chainalysis's reconstruction, the attackers spent months posing as a quantitative trading firm, building rapport with Drift contributors, and angling for elevated trust. The technical payload exploited Solana's "durable nonces" feature, which lets a transaction be signed now and broadcast later. Security Council members were tricked into pre-signing dormant transactions whose effects would only crystallize once the attackers held admin control.

Once they did, the rest was mechanical. The attackers whitelisted a worthless token they themselves controlled — labeled CVT — as eligible collateral, deposited 500 million CVT at a fabricated price, and used that artificial collateral to withdraw $285 million in real assets: USDC, SOL, and ETH. The drain took about twelve minutes.

The aftermath produced one number that DeFi analysts will be citing for years: roughly $232 million of the stolen USDC was bridged from Solana to Ethereum across more than 100 transactions over a six-hour window — using Circle's own Cross-Chain Transfer Protocol — without a single freeze action from Circle.

The Allaire "Moral Quandary" Defense​

Twelve days after the exploit, Circle CEO Jeremy Allaire took the stage at a press event in Seoul and laid out the company's reasoning. USDC freezes, he said, would only be executed at the direction of a court or law enforcement agency. Acting on suspicion alone — even credible, well-documented suspicion — would create what he called a "moral quandary": private corporations using their own discretion to seize what is supposed to be permissionless digital cash.

The framing was deliberate. Circle has spent the better part of three years branding USDC as the compliance-first stablecoin, the one regulators in Brussels, Singapore, and Washington can endorse without flinching. Allaire's argument is that this posture is the same posture that prevents Circle from acting like a vigilante. He has reportedly asked Congress to bake a "safe harbor" for issuer-led preventive freezes into the CLARITY Act so that Circle can act faster without bearing private liability.

Critics did not buy it. ZachXBT, the on-chain investigator whose reports tend to set the tone for these debates, published a tally claiming that delays in Circle's freeze process have allowed more than $420 million in illicit funds to escape USDC since 2022 across some fifteen documented cases. A class action lawsuit accusing Circle of negligence in the Drift exploit followed within days.

Allaire's defenders point out that the same compliance-first stance is precisely what protects ordinary holders from arbitrary seizures and government-by-press-release. The trade-off is real, and it is exactly the trade-off Drift's leadership decided it was tired of bearing.

Tether's Counter-Move: $148M and a Different Trust SLA​

On April 16, Drift unveiled the recovery package. Tether put up $127.5 million, with another $20 million coming from partners including Wintermute, Cumberland, and GSR. The structure is not a grant — it is revenue-linked, recovering its principal as Drift's reborn perpetuals venue earns fees, with a target of repaying the roughly $295 million in user balances over time.

The deal came with a switch most observers did not see coming: USDT, not USDC, would now be Drift's primary settlement asset. The protocol that had sent more than $230 million of stolen USDC across 100-plus bridge transactions while Circle watched would, going forward, denominate user balances and fees in Tether's stablecoin.

A week later, on April 23, Tether put a punctuation mark on the swap. In coordination with OFAC and U.S. law enforcement, it froze approximately $344 million in USDT on Tron, split across two wallets identified by PeckShield (one holding ~$213 million, the other ~$131 million) flagged for links to illicit activity, including the Drift and KelpDAO exploits.

The contrast was the message. Circle declined to freeze without a court order; Tether froze $344 million in coordination with — but ahead of — formal legal process. For a Drift Security Council still bleeding from a $285 million hole, the operational difference is what mattered.

Trust Becomes a Switchable SLA​

Until April 2026, "which stablecoin wins DeFi" was largely a liquidity question. USDC owned the cleanest regulatory story, the deepest fiat on-ramps, and the most natural integrations across Coinbase, MetaMask, and the Ethereum DeFi stack. USDT had bigger market share globally but was treated, in DeFi protocol design, as a secondary citizen behind USDC's reputational halo.

Drift's switch reframes that question entirely. If freeze posture is now a measurable Service Level Agreement that protocols can switch on, then "which stablecoin issuer responds fastest to my exploit" becomes a procurement decision, not a branding one. And on that axis:

  • Circle: publicly committed to court-order-only freezes, citing legal and reputational risk. Time-to-freeze is measured in days or weeks at best.
  • Tether: willing to freeze ad-hoc on credible flags, often inside hours, in coordination with — but not waiting on — formal process.

Neither posture is unambiguously "better." Circle's stance protects ordinary holders from over-eager intervention. Tether's stance protects DeFi protocols from realized losses. The difference is that, until now, very few protocols treated the choice as something they could actively pick. Drift just demonstrated that they can — and that an issuer is willing to back that choice with a nine-figure recovery commitment.

This is the part that should worry Circle's strategy team. The GENIUS Act, signed into law in July 2025, was widely read as a structural advantage for USDC: clean reserves, US licensing, MiCA compatibility, and the regulatory blessing that lets banks and treasurers hold the asset without legal review. Tether, lacking a US banking license, was supposed to be on the back foot inside the US perimeter.

But the Drift switch suggests a counter-thesis. In DeFi, where protocols self-custody and settle their own balances, regulatory ambiguity translates into operational flexibility. Circle's GENIUS Act compliance — the very thing that makes USDC bankable — is also what binds it to slower, court-mediated freezes. Tether's looser regulatory anchoring lets it act faster. For a perpetuals DEX whose users just lost half its TVL to Lazarus, faster wins.

Will Solana DeFi Follow?​

The open question is whether Drift remains an isolated case or the leading edge of a broader USDC-to-USDT rotation inside Solana DeFi. The signals so far are mixed but lean toward the latter.

  • Drift's deposit recovery: Roughly +12% deposit growth within 72 hours of the relaunch announcement, according to public TVL trackers. Users appear to reward the decisive backstop response rather than punish the issuer change.
  • Solana DeFi context: Total Solana DeFi TVL sat near $9.4 billion in early April 2026, with Jupiter, Kamino, Marinade, and Jito holding the largest concentrations. Drift's $285 million loss alone represented roughly 3% of that base.
  • Black April: April 2026 produced more than $606 million in DeFi exploit losses across 30 incidents, with TVL exodus exceeding $13 billion across affected protocols. The macro environment rewards protocols that can demonstrate operational resilience — and punishes those that cannot.
  • Jupiter's parallel move: Jupiter has been migrating $750 million of USDC liquidity into JupUSD, its Ethena-partnered stablecoin launched in late 2025. The motivation is yield, not freeze policy, but the directional message — Solana DeFi is willing to denominate balances in something other than USDC — was already present before Drift made it explicit.

If Kamino, Marginfi, or Jupiter signal a similar shift in the next ninety days, the "USDC dominance in DeFi" narrative will need a serious rewrite. If they do not, Drift becomes a cautionary footnote about a protocol that took an extraordinary measure under extraordinary pressure.

The Stablecoin Endgame Just Got More Interesting​

Three plausible endings are now in play.

Ending 1: Circle publishes a freeze policy. The simplest path back to status quo is for Circle to commit, publicly, to a defined freeze posture for designated DPRK-linked addresses. Allaire has hinted at wanting CLARITY Act safe harbor for exactly this. If Congress delivers, Circle can act faster without bearing private liability — and the operational gap with Tether closes.

Ending 2: USDT eats USDC's DeFi share. If protocols continue to migrate toward the issuer with the faster freeze SLA, Tether's ~60% market share holds and Circle's regulatory advantages plateau at the TradFi-payments layer rather than DeFi settlement. The GENIUS Act becomes a rule for who can serve banks, not who wins blockspace.

Ending 3: Bank-issued stablecoins eat both. The GENIUS Act explicitly opens the door for FDIC-insured banks to issue dollar tokens. JPMorgan, Bank of America, and a dozen regionals could enter the market with deposit infrastructure that dwarfs both Circle and Tether. In that world, Drift's choice between USDC and USDT looks quaint — both are private-issuer stablecoins, and the future belongs to JPM-USD or BofA-USD.

The ending DeFi gets depends on whether issuers compete on liquidity (Circle's home court), trust SLAs (Tether's home court), or balance-sheet credibility (the banks' home court). Drift just proved that protocols are now willing to switch on the second axis. The next ninety days will tell us whether anyone follows.

The Read-Through for Builders​

For developers and protocol teams watching this play out, three takeaways stand out:

  1. Stablecoin choice is now an architectural decision, not a default. Treat the issuer's freeze posture, recovery-pool willingness, and regulatory exposure as first-class design variables. Document them in your risk register.
  2. Recovery infrastructure is a moat. Tether's willingness to anchor a $127.5M backstop bought it a settlement-layer slot at the largest perp DEX on Solana. Issuers that cannot or will not stand up that capability will compete only on price and liquidity — and price/liquidity races compress to zero.
  3. High-frequency settlement workloads expose RPC fragility. A perp DEX recovering 12% of deposits in 72 hours produces concentrated load on signature confirmation, account balance queries, and indexer endpoints. Infrastructure that quietly handled DEX swaps starts to crack under agent-style traffic patterns.

BlockEden.xyz operates production-grade Solana RPC and indexer infrastructure built for the high-frequency, deterministic settlement patterns that perpetuals protocols and recovery flows demand. Explore our Solana API services to build on infrastructure designed to absorb the next Black April rather than amplify it.

Sources​

The $1.22 Hack: Ledger's CTO Says AI Has Broken Crypto Security Economics

· 13 min read
Dora Noda
Dora Noda
Software Engineer

A working smart contract exploit now costs about $1.22 in API credits to generate. That single number, surfaced by Anthropic's red team in late 2025 and reinforced by an academic exploit-generator that extracted up to $8.59 million per attack, is the backdrop to the warning Ledger CTO Charles Guillemet issued on April 5, 2026: artificial intelligence is not breaking cryptography. It is breaking the economics of crypto security, and the industry's traditional defenses were never priced for this regime.

If 2024 was the year AI rewrote how developers ship code, 2026 is the year it rewrote how attackers ship exploits. The asymmetry has flipped so fast that even the firms that have spent a decade building hardware wallets are now asking whether the entire trust model needs a rewrite.

What Guillemet Actually Said​

Speaking publicly in early April, Guillemet — the chief technology officer at Ledger and a longtime hardware security researcher — laid out an uncomfortable thesis. The cost-to-attack curve for crypto is collapsing because large language models are competent enough to do the hardest parts of an attacker's job: read unfamiliar Solidity, reason about state machines, generate plausible exploit transactions, and iterate against on-chain forks until something works.

His framing was deliberately economic. Cryptography is not weaker today than it was in 2024. Hash functions still hash. Elliptic curves still curve. What changed is that the labor input behind a successful attack — the senior auditor's eye, the months of patient reverse engineering — has been compressed into a budget line that fits inside a single Anthropic or OpenAI invoice. "We are going to produce a lot of code that will be insecure by design," Guillemet warned, pointing to the second-order effect of developers shipping AI-generated Solidity faster than reviewers can read it.

Ledger's number for last year's losses sits at roughly $1.4 billion in directly attributable hacks and exploits, with broader scam-and-fraud totals reaching far higher depending on whose accounting you accept. Chainalysis put 2025's total stolen-funds figure at $3.4 billion. CoinDesk's January 2026 retrospective pegged the wider scam-and-impersonation universe at as much as $17 billion. Whichever figure you trust, the trend line is the wrong direction, and Guillemet's argument is that the trajectory is now AI-shaped.

The Anthropic Number That Changed The Conversation​

In December 2025, Anthropic's own red team published results from SCONE-bench — a benchmark of 405 smart contracts that were actually exploited between 2020 and 2025. The headline statistic was blunt. Across all 405 problems, modern frontier models produced turnkey exploits for 207 of them, a 51.11% hit rate, totaling $550.1 million in simulated stolen value.

More disturbingly, when the same agents were pointed at 2,849 freshly deployed contracts that had no known vulnerabilities, both Claude Sonnet 4.5 and GPT-5 surfaced two genuine zero-days and produced working exploits worth $3,694 — at an API cost of roughly $3,476. That ratio is barely break-even on paper, but it dismantles the assumption that zero-day discovery requires a human team.

Independent academic work tells the same story from the other side. The "A1" system, published on arxiv in 2025 and updated through early 2026, packages any LLM with six domain-specific tools — bytecode disassemblers, fork executors, balance-trackers, gas-profilers, oracle-spoofers, and state-mutators — and points it at a target contract. A1 hit a 62.96% success rate on the VERITE exploit dataset, beating the previous fuzzing baseline (ItyFuzz, 37.03%) by an enormous margin. Per-attempt costs ran $0.01 to $3.59. The largest single payday it modeled was $8.59 million.

These are not theoretical numbers. They are the input cost of an exploit. And once that input cost reaches the price of a fast-food meal, the question stops being "can attackers afford this" and starts being "can defenders afford to miss anything."

The 1000:1 Throughput Mismatch​

Here is the part of the picture that audit firms are still struggling to articulate. Auditors charge per engagement. They review one codebase at a time, often over weeks, and their AI tooling — when they use it — is bolted onto a workflow with humans in the loop and bills to send. Attackers, by contrast, can rent the same models, point them at thousands of contracts in parallel, and only pay when something works.

A Frontiers in Blockchain paper from early 2026 captured the asymmetry in a single line: an attacker turns a profit at roughly $6,000 in extractable value, while a defender's break-even is closer to $60,000. The 10x gap is not because defense is technically harder — it is because defense has to be complete, and offense only has to be correct once.

Stack that against the volume mismatch — call it 1000:1 between contracts an attacker can scan and contracts an audit firm can review — and you arrive at Guillemet's conclusion almost mechanically. No audit budget can close this gap. The economics simply do not work.

What 2026's Big Hits Already Tell Us​

The hacks that have actually landed in 2026 do not all read as "AI exploit" stories on the surface. The two largest losses of the year so far are sobering reminders that LLM-assisted attack tooling is layered on top of older, more boring techniques.

On April 1, 2026, Drift Protocol on Solana lost $285 million — over half its TVL — in an attack TRM Labs and Elliptic both attributed to North Korea's Lazarus Group. The mechanism was social engineering, not a Solidity bug. Attackers spent months building relationships with the Drift team, then abused Solana's "durable nonce" feature to get Security Council members to pre-sign transactions whose effect they did not understand. Once admin control flipped, the attackers whitelisted a worthless token (CVT) as collateral and used it to drain real USDC, SOL, and ETH.

Eighteen days later, Kelp DAO took a $292 million hit through its LayerZero-powered bridge — now the largest DeFi exploit of 2026. The attacker convinced LayerZero's cross-chain messaging layer that a valid instruction had arrived from another network, and Kelp's bridge dutifully released 116,500 rsETH to an attacker-controlled address. Lazarus again, by most attributions.

What does this have to do with AI? Two things. First, the reconnaissance that makes long-tail social engineering possible — profile-mapping, message-tone matching, picking the right moment in a target's calendar — is exactly what LLMs are good at. CertiK's 2026 forecast already names phishing, deepfakes, and supply-chain compromise as the dominant attack vectors for the year, and notes a 207% jump in phishing losses from December 2025 to January 2026 alone. Second, AI lowers the barrier to parallel operations: where a Lazarus-grade team could run a few campaigns at a time in 2024, AI tooling lets a much smaller crew run dozens.

A reminder of how granular this can get came in April 2026 when Zerion, a popular wallet app, disclosed that attackers used AI-driven social engineering to drain roughly $100,000 from its hot wallets. The number is small by 2026 standards. The technique — AI generating the impersonation script, AI generating the fake support page, AI generating the phishing email — is what Guillemet is warning about.

Why "Just Audit Harder" Is Not An Answer​

The instinctive industry response is to fund more audits. That response is missing the shape of the problem.

Audits scale linearly with auditor hours. Attacks now scale with API credits. Even if every Tier-1 audit firm doubled headcount tomorrow, the attacker's surface area would still be growing 10x faster, because anyone with an API key and a basic understanding of Solidity can now run continuous offensive scans across the entire deployed contract universe.

Worse, audits review code at a moment in time. AI-generated code is being shipped continuously, and Guillemet's "insecure by design" warning suggests the bug-introduction rate is going up, not down. A 2026 study cited by the blockchain-security community found that LLM-assisted Solidity authorship correlates with subtle reentrancy and access-control mistakes that human reviewers, fatigued by reading machine-formatted code, miss at higher rates than they miss the same bugs in human-authored code.

The honest framing is that audits remain necessary but not sufficient. The actual answer Guillemet pushes — and that Anthropic's own red team echoes — is structural.

The Defensive Stack That Actually Survives This​

Three categories of defense plausibly scale against AI-accelerated offense, and all three are uncomfortable for the part of the industry that has optimized for shipping speed.

Formal verification. Tools like Certora, Halmos, and increasingly the verification stacks bundled with Move (Sui, Aptos) and Cairo (Starknet) treat correctness as a math problem rather than a review problem. If a property is proved, no amount of AI fuzzing can break it. The trade-off is engineering effort: writing meaningful invariants is hard, slow, and unforgiving. But it is one of the few defenses whose cost does not scale with the attacker's compute.

Hardware roots of trust. Ledger's own product line is the obvious example, but the broader category includes secure enclaves, MPC custody, and emerging zero-knowledge attestation primitives. The principle is the same: take the most consequential action — signing a transaction — and force it through a substrate that an LLM-driven phishing campaign cannot reach. Guillemet's "assume systems can and will fail" framing is essentially an argument for moving signing authority off general-purpose computers.

AI-on-AI defense. Anthropic's December 2025 paper makes the case that the same agents capable of generating exploits should be deployed to generate patches. In practice this means continuous AI-driven monitoring of mempools, deployed contracts, and admin-key behavior — flagging anomalies the way fraud-detection systems do for traditional banking. The economics are imperfect (defender costs are still higher than attacker costs) but they at least put both sides on the same compute curve.

The pattern across all three is the same: stop relying on humans-in-the-loop for the fast parts of security, and reserve human judgment for the slow, expensive, structural parts.

What This Means For Builders Right Now​

For teams shipping in 2026, Guillemet's warning translates into a few concrete shifts:

  • Treat AI-generated code as untrusted by default. Run it through formal verification or property-based testing before it touches mainnet, regardless of how clean it looks.
  • Move admin keys behind hardware. Multi-sig with hot signers is no longer an acceptable security posture for treasury-grade contracts; the Drift incident proved that even "trusted" team members can be socially engineered into pre-signing destructive transactions.
  • Assume your phishing surface is bigger than your code surface. The Zerion drain ($100K) and the broader 207% phishing jump suggest the cheapest attacker dollar is still aimed at humans, not at Solidity.
  • Budget for continuous, automated monitoring. A weekly audit cadence is not a defense against an attacker that runs SCONE-bench-grade tooling 24/7.

None of these are new ideas. What changed is the urgency curve. In the pre-LLM era, an organization could survive lapses in any one of these areas if the others were strong. In 2026, the cost asymmetry is too steep for that kind of slack.

The Honest Read​

It is tempting to read Guillemet's warning as Ledger talking its book — a hardware-wallet vendor naturally argues for hardware. That reading would be a mistake. The same case is being made independently by Anthropic's red team, by academic groups behind A1 and SCONE-bench, by CertiK's 2026 forecast, and by chain-analytics firms watching the monthly hack totals. The industry consensus is converging on a single point: the cost of a competent exploit has dropped by one to two orders of magnitude, and the defensive stack must move accordingly.

What is genuinely new is that this is the first major asymmetric shift in crypto security since the early 2020 DeFi-summer wave of audit demand. That wave produced a generation of audit firms, bug-bounty platforms, and formal-verification startups. The 2026 wave will produce something else: continuous AI-monitored infrastructure, hardware-rooted signing as a default, and a much harsher skepticism of any contract whose security model still depends on "we'll catch it in review."

Guillemet's $1.22 number — even if that exact figure was Anthropic's, not Ledger's — is the kind of statistic that ends an era. The era it ends is the one where attacker labor was the bottleneck. The era it begins is the one where the bottleneck is whatever the defender has not yet automated.

BlockEden.xyz operates blockchain RPC and indexing infrastructure across Sui, Aptos, Ethereum, Solana, and 20+ other networks, with AI-assisted anomaly monitoring built into the request path. If you are rebuilding your security posture for the post-LLM threat landscape, explore our infrastructure services or reach out to discuss continuous monitoring for your protocol.

Sources​

Vercel + Lovable Breaches: How AI Tools Became Web3's New Supply Chain Risk

· 13 min read
Dora Noda
Dora Noda
Software Engineer

In a single week of April 2026, two seemingly unrelated SaaS incidents collided in a way that should reset every Web3 team's threat model. Vercel — the deployment platform under thousands of wallet UIs and dApp frontends — disclosed that an attacker had pivoted into its environment via a compromised AI productivity tool called Context.ai. Days later, vibe-coding platform Lovable was caught leaking source code, database credentials, and AI chat histories across thousands of pre-November-2025 projects through an unfixed authorization bug. The two stories share no shared infrastructure. They share something worse: the same blast pattern, where AI tools quietly became privileged identities inside the developer toolchain — and Web3 inherited the risk without ever pricing it.

Smart contract audits, multisig governance, hardware wallet signing — none of these defenses sit in the path that an attacker takes when they compromise the build pipeline that ships your users' transaction-approval UI. April 2026 made that gap visible. Whether the industry treats it as a wake-up call or another absorbed loss depends on what the next quarter looks like.

Solana's 3-Year Quantum Wedge: Why Yakovenko Told Ethereum L2 Users to Abandon All Hope

· 12 min read
Dora Noda
Dora Noda
Software Engineer

On May 2, 2026, Anatoly Yakovenko did something most blockchain co-founders avoid: he told an entire cohort of users that their network was beyond saving. "Abandon all hope," the Solana Labs co-founder wrote, was the only honest advice for anyone holding assets on an Ethereum Layer 2 and worrying about quantum computers. The tweet landed the same hour Anza and Firedancer — the two clients that secure the bulk of Solana's validator stake — published production-hardened test builds verifying Falcon-512 signatures, the lattice-based scheme NIST selected as a post-quantum standard.

That synchronicity was not an accident. It was the loudest cross-chain marketing salvo since Vitalik's Plasma deck in 2017, and it reframed quantum readiness from a 2030s engineering checklist into a 2026 competitive wedge. While Ethereum's "Strawmap" plots seven hard forks on a six-month cadence, finishing post-quantum infrastructure around 2029, Solana now has working Falcon-512 verification in two independent client implementations. The gap is roughly three years — and three years is enough time to win an institutional narrative.

The $1.5 Billion Wake-Up Call: How Supply Chain Attacks Became Web3's Deadliest Threat in 2025

· 10 min read
Dora Noda
Dora Noda
Software Engineer

When security researchers released the final tally for 2025, the number that stopped everyone cold wasn't the record-breaking $3.35 billion in total Web3 losses — it was how that money was stolen. For the first time, software supply chain attacks claimed the top spot as the single most destructive attack vector, accounting for $1.45 billion in losses across just two incidents. Smart contracts, flash loans, oracle manipulation — the classic Web3 exploits — didn't come close. The battlefield has shifted, and most of the industry is still fighting the last war.

DeFi's Quiet Triumph: How $15.7B in Liquidations Proved the Protocols Actually Work

· 9 min read
Dora Noda
Dora Noda
Software Engineer

When Bitcoin fell 43% from its all-time high and the crypto Fear & Greed Index spent 46 consecutive days in "extreme fear" territory, something surprising happened: the decentralized finance protocols at the heart of crypto's financial system just kept running. No insolvencies. No emergency governance interventions. No bailouts.

The Q1 2026 liquidation cascade — one of the largest in DeFi history — turned out to be a quiet, involuntary stress test that the industry passed with remarkable composure. It's worth understanding exactly why, and what it means for the next phase of on-chain finance.

Aave's SOC 2 Type II: How DeFi's First Enterprise Compliance Audit Unlocks Institutional Capital

· 11 min read
Dora Noda
Dora Noda
Software Engineer

For a decade, every DeFi pitch deck to a bank ended at the same wall. The protocol's TVL was huge, the smart contract audits were stacked five deep, and the yields were better than anything the institution could source on its own desk. Then the procurement team asked one question — "Where's your SOC 2?" — and the deal went quiet.

In April 2026, Aave Labs answered that question. The team behind the largest decentralized lending protocol obtained SOC 2 Type II attestation covering Security, Availability, and Confidentiality across Aave Pro, Aave Kit, and the Aave App. It is the first time a top-tier DeFi protocol has cleared the same operational-controls bar required of enterprise SaaS providers, cloud platforms, and regulated financial infrastructure.

This is not a press release crypto people will instinctively get excited about. There is no token unlock, no TVL spike, no airdrop. But for the bank risk committees, asset-management compliance officers, and corporate treasurers who have spent two years circling DeFi without being able to actually buy in, the certification removes one of the last structural blockers. And it changes what "trustless" is allowed to mean.

Why a SaaS Audit Standard Suddenly Matters in DeFi​

SOC 2 — the System and Organization Controls framework administered by the AICPA — is the certification that decides whether enterprise procurement teams will let you in the door. Every Slack-tier B2B SaaS vendor lives or dies by it. Type I says you have controls; Type II says those controls actually worked, continuously, over a sustained observation window of six months or more.

The Aave attestation reportedly examined the development workflows, software protections, information-handling procedures, and operational practices applied to the protocol's release lifecycle. That is the unsexy operational machinery: how engineers get production access, how incidents are detected and escalated, how data flows are documented, how change management gets approved.

DeFi has historically pushed back on this kind of evaluation with a reasonable argument: the protocol is the contract, and the contract is the audit. Trail of Bits, OpenZeppelin, and Certora have built entire businesses on adversarial code review of Solidity. Why does anyone need a managed-services audit on top of immutable infrastructure?

The answer became unavoidable in 2024 and 2025. Smart contract audits look at code at a single point in time. They cannot tell a regulated allocator how the development team handles a zero-day disclosure at 2 a.m., who has the keys to the front-end deployment pipeline, whether the multisig signers have phishing-resistant MFA, or whether the team's vendor list includes a known-compromised npm dependency. Those are organizational questions, and SOC 2 Type II is the language enterprise risk teams use to ask them.

The Procurement Wall, Briefly Explained​

If you have never sold software to a regulated financial institution, here is the workflow that breaks deals: a business sponsor at the bank wants to use a DeFi protocol. They write up a use case. The use case goes to a vendor risk team, which sends back a 200-question security questionnaire. Question 14 is "Provide your SOC 2 Type II report from the last 12 months." Until 2026, no DeFi protocol could check that box.

The substitute answers — "we are decentralized, the contracts are immutable, here are seven Trail of Bits reports" — were intellectually correct and procedurally useless. Vendor risk frameworks are built around recognized control attestations, not philosophical defenses of trustlessness. There is no ISO 27001 equivalent for "we don't have a CEO."

Aave's SOC 2 does not eliminate the awkwardness of explaining DAO governance to a credit committee, but it satisfies the procedural step that has been killing pilots before they reach a contract. That is the difference between possible and executable in enterprise sales.

Catching Up to the Custody Layer​

Aave is not introducing SOC 2 to crypto. The custody and exchange layers got there years ago.

  • Fireblocks holds SOC 2 Type II alongside ISO 27001, SOC 1 Type II, ISO 27017/27018, and CCSS Level 3.
  • Coinbase Custody is SOC 1 Type II and SOC 2 Type II audited by Deloitte & Touche.
  • BitGo carries the SOC certifications expected of a qualified custodian, alongside roughly $250–320 million in Lloyd's of London insurance coverage.

Custodians cleared the bar because they had to: their entire product is "we hold your assets and we are trustworthy." Exchanges followed for institutional-broker reasons. What was missing — until now — was the protocol layer. A bank could custody assets at Coinbase, route trades through Fireblocks, and still have nowhere to actually deploy capital on-chain because the lending protocol on the other end had no comparable certification.

Aave's SOC 2 closes that gap on the asset side. The vertical institutional stack now reads: qualified custodian (SOC-attested) → trading and settlement platform (SOC-attested) → lending protocol (SOC-attested). Every link is now legible to a vendor risk team using the same checklist.

Horizon, the $550M Wedge​

The certification is not happening in a vacuum. It is happening on top of Aave Horizon — the permissioned market Aave launched specifically to let qualified institutions borrow stablecoins against tokenized real-world assets like US Treasuries.

Horizon currently sits at roughly $550 million in net deposits, and Aave's 2026 roadmap targets $1 billion by year-end through expanded partnerships with Circle, Ripple, Franklin Templeton, and VanEck. Those are not opportunistic crypto-curious counterparties. They are issuers of the tokenized assets that show up in actual institutional portfolios, and they are exactly the names that vendor risk committees recognize.

Horizon is the demand signal. SOC 2 is the procurement enabler. They were always going to ship together; one without the other would be incomplete. A permissioned RWA market with no compliance attestation is a beta product. A SOC 2 attestation with no institutional-grade venue to deploy into is a credential nobody asked for. Together, they are a thesis: that DeFi's next leg of growth will be measured in the dollar volume of capital that couldn't previously enter and now can.

The "Trust the Code AND the Org" Era​

The deeper shift here is in what DeFi is willing to claim about itself.

The 2020-era pitch was "trust the code." Smart contracts are deterministic, audits are public, governance is on-chain — therefore, the protocol can be evaluated entirely on its software. That story worked for crypto-native users who were comfortable with Etherscan as the source of truth and a Discord channel as the support desk.

It never worked for the institutional layer, because real allocators evaluate counterparty risk, not just code risk. They want to know who can push to the front-end repo, what happens if the team's domain registrar is socially engineered, whether the on-call engineer has the access necessary to respond to a live exploit, and whether incident response has been rehearsed. None of that is in the smart contract. All of it is in the SOC 2 scope.

The new pitch is "trust the code AND the organization running it." That is a less elegant slogan, but it matches how every other piece of regulated financial infrastructure is actually evaluated. AWS isn't trusted because S3 is open source; it's trusted because Amazon's controls are audited. Visa isn't trusted because card networks are mathematically secure; it's trusted because VisaNet has decades of attested operational practice. DeFi is now starting to play that game.

There is a cost to this. The protocol layer of crypto was supposed to be the place where organizational trust didn't matter. SOC 2 reintroduces a centralized-team concept — Aave Labs, the Avara entity, the engineering organization — into the trust model in a way that uncomfortably resembles a normal company. The decentralization maximalist objection here is real. The counter-objection is that the only DeFi protocols that will receive institutional flows in 2026 are the ones willing to be audited like normal companies, and the gap between those two cohorts is about to widen quickly.

What Other Protocols Are Now Forced To Decide​

Aave just set a new minimum. Every other top-tier DeFi protocol now has a strategic question with a 12-month clock on it: do they pursue SOC 2 attestation, or accept that they are competing only for crypto-native capital while Aave compounds a structural advantage on regulated flows?

The candidates with the most obvious motivation:

  • Uniswap Labs — sits on the trading side of the same procurement question. A SOC 2 attestation on the front-end and Uniswap X infrastructure would unlock institutional swap flow currently routed through OTC desks.
  • Maple Finance — already serves institutional credit; its TVL grew from $500M to over $4B by serving crypto-native institutions. SOC 2 is the natural progression to bank-tier counterparties.
  • Morpho — building an aggressively institutional posture with curated vaults; its competitive position against Aave Horizon depends on matching compliance credentials.
  • Compound, Spark, Pendle — each faces the same question with different urgency depending on how directly they target institutional yield.

The protocols that move first will have the same advantage Stripe had over earlier payment processors: not a better product, but a procurement story that lets the buyer say yes faster. The protocols that don't move risk being structurally locked out of the next $100B+ in DeFi inflows even if their on-chain metrics look great.

The Other Audit That Still Matters​

None of this displaces the smart contract audit. The two evaluations cover non-overlapping risk surfaces. SOC 2 will not catch a reentrancy bug in a new asset listing. A Trail of Bits review will not tell you whether the on-call engineer can actually be paged at 3 a.m. on a Sunday. Forward-looking institutional risk frameworks for DeFi are converging on a layered model where both attestations are required, plus increasing demands for runtime monitoring, formal verification of critical paths, and bug bounty programs at meaningful payout levels.

Aave has the easier hand here because its codebase is among the most heavily audited in DeFi history and its bug bounty program has been operational at scale for years. For protocols starting from a thinner audit history, the SOC 2 process will surface adjacent gaps — change management, vendor inventory, access reviews — that have to be fixed before the operational controls can even be evaluated. The certification timeline is typically 9–18 months from kickoff to first Type II report, which is also roughly the window in which institutional DeFi adoption is going to be decided.

What This Means for Infrastructure Providers​

The SOC 2 cascade does not stop at the protocol. Infrastructure that protocols and their institutional counterparties depend on — RPC endpoints, indexers, data providers, signing services — gets pulled into the same compliance frame. A bank's vendor risk team that just approved Aave is going to ask the same SOC 2 question of every dependency that touches its transactions.

That is going to be uncomfortable for parts of the Web3 infrastructure stack that have operated on a "best effort" reliability model. RPC nodes that go down without an SLA, indexers with informal change management, key-management services without documented access controls — none of those survive a real institutional vendor review. The infrastructure layer is about to get the same procurement conversation the protocol layer just navigated.

The providers that meet the bar early get to be the institutional default. The providers that don't get displaced as soon as a competitor with a clean SOC 2 walks into the room.

BlockEden.xyz operates production-grade Web3 infrastructure across Sui, Aptos, Ethereum, and twenty-plus other chains, with the kind of operational discipline institutional buyers are starting to require from every layer of the DeFi stack. Explore our API marketplace to build on infrastructure designed for the institutional era.

The Quiet Inflection​

It is possible to overstate what one attestation does. Aave's SOC 2 will not, by itself, bring a wave of bank-tier capital onto Horizon next quarter. Procurement cycles are slow, and the legal-enforceability and accounting questions around DeFi participation remain partially unresolved. The first sovereign wealth fund to lend through a permissioned Aave market is still a 2027 story at the earliest.

But this is the kind of moment that gets pointed to later, after the curve has already bent. The 2020 and 2021 cycles built the on-chain machinery. The 2024 and 2025 cycles built the regulatory and tokenized-asset rails. The 2026 cycle is building the operational-trust layer that lets everything else actually be used by the institutions that have been watching from the outside.

Aave's SOC 2 Type II is the first protocol-layer brick in that wall. The protocols that figure out it's a wall — and start building toward it now — will define the next decade of DeFi. The ones that wait for the regulator or the auditor to come to them will spend that decade explaining why their on-chain TVL never converted into the institutional flows everyone keeps predicting.

The infrastructure of trust is being rebuilt one attestation at a time. Aave just placed the first one.

Carrot Protocol's Shutdown Just Proved DeFi's Composability Was a Contagion Vector All Along

· 14 min read
Dora Noda
Dora Noda
Software Engineer

Carrot Protocol never got hacked. Its smart contracts were not compromised, its admin keys were not phished, and its team did not rug. Yet on April 30, 2026, the Solana yield aggregator told its users to withdraw everything by May 14 because half of its TVL had vanished into someone else's exploit.

That "someone else" was Drift Protocol, the perpetual futures venue that lost roughly $285 million on April 1 to what investigators believe was a North Korea-linked durable-nonce attack. Carrot's Boost and Turbo products had been quietly routing user deposits through Drift-integrated vaults. When Drift bled, Carrot bled. About $8 million of Carrot's roughly $16 million in deposits at the time were drained downstream — 50% of TVL gone overnight, with no mistake of Carrot's own.

Thirty days later, Carrot is the first protocol to formally shut down because of that exposure. It will almost certainly not be the last. Its closure is the moment the DeFi industry can no longer hand-wave away the question that has been sitting under the surface since 2020: when "money LEGOs" snap together, who owns the failure when one block underneath gives way?