How crypto and blockchain are changing the cybersecurity landscape [Q&A]

In 2016, the DAO hack shook the crypto world with a $60 million loss. Today, a single DeFi exploit can drain $600 million in minutes. Blockchain protocols have gone from securing thousands or millions of dollars to billions in just a few years.

This fundamentally changes everything, and the security playbook hasn’t kept pace. We spoke to Sahaj Gandhi, lead machine learning engineering at Octane to learn more about the problem and how to address it.

BN: How has the explosion of value locked in blockchain protocols fundamentally changed the cybersecurity landscape for crypto developers?

SG: We’ve now seen over $11 billion lost to smart contract attacks. Blockchain teams are hemorrhaging money, both to security costs and to exploits. When companies spend $200,000 on security and still get hacked, it’s clear something fundamental is broken in our approach.

Today, a single bug can lead to catastrophic, irreversible losses in the millions. What makes this even more challenging is that once code is deployed on-chain, it’s often immutable. You can’t just push an update like with traditional software.

What keeps developers up at night is this terrible asymmetry. They have to secure every possible path, while attackers only need to find one vulnerability. And since smart contract code is public, attackers can study it endlessly looking for that one weakness.

At Octane we’ve witnessed countless exploits happening across the industry, and it became clear there was an urgent need to fix these security problems. I’ve talked to teams who live with constant anxiety that they missed something that could drain their protocol overnight.

BN: Why have traditional code auditing approaches proven insufficient against the unique security challenges of decentralized finance?

SG: Audits absolutely have their place. They’re a valuable layer of security, but on their own, they’re not enough. Traditional audits are point-in-time reviews. Code can change after the audit, and then get deployed or upgraded without another check. Even the best audit can’t guarantee zero vulnerabilities. It simply aims to find as many bugs as possible within a fixed scope and timeframe.

At Octane, we’ve seen this firsthand with bugs ranging from low to high severity slipping through traditional audits. Teams come to us post-audit, ready to deploy, and our AI uncovers vulnerabilities that were either missed directly, misclassified as low severity, or hidden in dependency code that was not fully reviewed.

Security in crypto can’t be only a point-in-time check. It needs to be continuous. Getting a single manual review is like getting a health checkup once a year and expecting to stay healthy no matter what you do the other 364 days.

We strongly believe that increasing the layers of pre-deployment security reduces the likelihood of costly exploits in production. The safest path forward is a layered approach: continuous security with tools like Octane, combined with manual audits for point-in-time checks, rigorous testing harnesses, formal code verification, and simulation testing.

BN: How does AI-powered continuous code analysis transform the developer experience when building on blockchain infrastructure?

SG: It completely changes how developers think about security. Instead of an anxiety-inducing cycle where you build for weeks or months and then hold your breath during an audit, security becomes integrated into your daily workflow.

We’ve built an AI security engineer that never sleeps and helps developers fix issues before they become exploits. Unlike traditional static analysis tools that flood developers with false positives, or audit firms that take weeks to deliver reports, our system provides instant, actionable fixes right in the development workflow.

The process looks like this: A developer unknowingly pushes code with a vulnerability that could drain user funds. Before it reaches production, our system flags the issue, explains what’s wrong, and shows exactly how to fix it — all within the normal workflow.

We saw this in action with Rhinestone. Our system caught a critical vulnerability during development that would have allowed an attacker to drain funds. Octane identified it during development, explained the issue in clear language, and provided an immediate code fix. This prevented what could have been another multi-million dollar exploit.

This AI security layer operates 24/7, constantly watching over your codebase. It uses pattern recognition trained on thousands of past exploits, symbolic execution to trace potential attack paths, and natural language processing to understand developer intent, catching vulnerabilities that simple rule-based systems miss. It integrates directly into development workflows, so developers don’t have to switch contexts or platforms to think about security. The system flags issues right in pull requests before deployment, catching vulnerabilities at the exact moment they’re introduced.

What makes this approach particularly powerful is that it doesn’t just identify problems — it provides clear explanations and ready-to-implement code fixes. Developers don’t need to be security experts to ship secure code.

Developers tell us this creates a profound shift. As one team lead put it, “I used to wake up at 3 AM checking Discord for exploit alerts. Now I actually sleep through the night knowing our AI security layer is watching every line of code.” They move from constant worry to having confidence that vulnerabilities are caught in real-time. They can focus on building features rather than obsessing over what they might have missed.

We’re seeing teams ship faster because they’re no longer blocked waiting for audit slots. When a vulnerability is found, they get auto-generated code diffs so they can fix issues immediately without disrupting their workflow.

Our AI models improve over time as they learn from each codebase. False positives decrease, and the detection becomes more tailored to each project’s specific patterns.

Our goal is to change how developers fundamentally think about security: to build it in from day one, instead of tacking it on a few weeks before launch. When teams experience how starting with security actually saves time by letting them fix issues earlier, it transforms their entire development process.

Security tools are only useful if they’re actionable. We’ve designed everything to be clear and straightforward, highlighting the most serious issues so they get immediate attention instead of being buried in warnings.

BN: What connection exists between improved smart contract security and mainstream crypto adoption?

SG: Security is the invisible infrastructure of trust. Mainstream users won’t adopt platforms they don’t trust with their money. Every major hack sets adoption back significantly; not just for the affected protocol but for the entire ecosystem.

The $11 billion lost to smart contract attacks has created a massive barrier to mainstream adoption. When potential users read headlines about another protocol getting drained, they reasonably conclude that blockchain technology isn’t ready for their assets.

I’ve had conversations with institutional investors who are interested in DeFi yields but can’t allocate capital until they have stronger security assurances. The same applies to regular users; they hear about a $100 million hack and immediately think, ‘This technology isn’t ready.’

Security failures also attract regulatory scrutiny. When we see major exploits, it often triggers reactionary policies that can stifle innovation. Building secure systems from the start helps avoid this regulatory backlash.

The best security is invisible to users. They don’t see all the vulnerabilities that were prevented – they just have a smooth, trustworthy experience. This positive user experience is essential for bringing the next wave of adoption.

There’s a virtuous cycle when security improves. As protocols become more secure, more users join, which increases the value and utility of the ecosystem, which attracts even more users. Security is the foundation that makes this growth possible.

BN: How will the relationship between AI and blockchain security evolve as both technologies mature?

SG: Right now, we’re in the integration phase. AI security tools are becoming standard parts of blockchain development workflows. But that’s just the start.

As both technologies mature, we’ll see AI models develop a deeper understanding of protocol-specific vulnerabilities. They’ll become more specialized and nuanced in their detection capabilities.

What I’m particularly excited about is the predictive potential. Right now, we’re mostly catching known vulnerability patterns, but advanced AI systems will eventually anticipate new attack vectors before they’re exploited in the wild.

We’re already working on expanding beyond Solidity to other smart contract languages and eventually traditional programming languages too. As AI security tools become more universal, we’ll see collaborative security emerge, where systems from different protocols share threat intelligence.

Our approach combines supervised and unsupervised ML. We use unsupervised learning to understand the vulnerability landscape and supervised methods to build precise detection capabilities. This hybrid approach will become increasingly powerful as our models advance.

There’s a delicate balance we strike between specificity and generality in our taxonomy. More general categories help us catch weird edge cases that don’t fit neatly anywhere, while specific categories give users better explanations and help us catch known bugs more consistently.

The relationship between AI and blockchain security will ultimately be co-evolutionary. As defenders adopt more sophisticated AI tools, attackers will follow suit. This creates a dynamic environment where both attack and defense continuously advance. Our job is to make sure defense stays several steps ahead. The question for every blockchain developer today is this: Will you wait for the next $100 million hack to make headlines, or will you build security into your protocol from day one? The tools exist. The choice is yours.

Image credit: Acnalesky/Dreamstime.com