Since January 2023, control hijacking has caused up to $3.31 billion in losses across the crypto ecosystem. The figures from ChainLight’s Lumos tracker were shared by Monad co-founder Keone Hon in a guide titled Crypto OpSec Bible. Losses stemming from control takeovers vastly eclipsed those caused by smart contract vulnerabilities over the same period, which totaled $983 million.
Hon urged all crypto teams and developers to prioritize operational security, or OpSec. The warning comes as attackers increasingly leverage artificial intelligence (AI) to exploit weaknesses outside of protocol code.
Why Control Hijacks Far Outpace Code Vulnerabilities
Lumos data highlights a shifting risk landscape across the crypto industry. The control hijacking category encompasses social engineering, private key leaks, account takeovers, and supply-chain attacks. All four vectors focus on seizing administrative privileges, rather than directly exploiting flaws in smart contract code.
Regarding administrative authority, Hon warned developers against relying on externally owned accounts (EOAs) to carry out protocol administrator roles. For critical administrative functions, Hon recommended using a dedicated laptop specifically prepared for signing transaction instructions.
Testing Protocols with Ultrafuzz AI Agents
Alongside the OpSec guide, the Monad Foundation released and promoted an open-source testing tool named Ultrafuzz on GitHub. The software is designed to help uncover vulnerabilities in Solidity- and Vyper-based smart contracts.
Developer Antonio Viggiano designed Ultrafuzz by coordinating specialized AI agents. This suite of agents is tasked with mapping user flows, probing protocol security boundaries, and executing fuzzing strategies - a testing technique that injects varied inputs to discover system vulnerabilities.
Prior to its public release, the Ultrafuzz tool underwent more than 20 testing rounds across projects within the Monad ecosystem.
Strict Rules for Running Unrestricted Permission Tools
Despite being aimed at strengthening code defenses, Monad issued strict instructions for anyone testing Ultrafuzz. The tool must only be run inside an isolated, disposable virtual machine (VM).
These instructions were issued because the AI agents inside Ultrafuzz operate with unrestricted permissions. That autonomous operational model poses risks if run directly on a developer machine that stores credentials or access keys.
For developers in the Web3 ecosystem, the new guide and tool highlight two fronts of security: leveraging AI agents to test smart contract vulnerabilities in isolated environments, while isolating administrative access roles on separate devices.
Reported via crypto.news.
Also read: What Is DeFi (Decentralized Finance)?
Also read: Uber Deploys Cash Over Weekend Market Closures - Earns Extra 1.5 Days of Yield via Blockchain
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
