NEAR Protocol co-founder and CEO Illia Polosukhin issued a warning on July 20, 2026, according to reporting by The Block, stating that AI-assisted hacking has moved faster than the blockchain industry's code review practices can keep up with.

Writing on Substack since May 2026, Polosukhin has called formal verification, the process of mathematically proving that code behaves exactly as intended, a necessary shift rather than an optional upgrade for anyone deploying smart contracts today.

The warning carries unusual weight. Polosukhin is one of eight co-authors of the 2017 Google Brain paper "Attention Is All You Need," the research that introduced the Transformer architecture underlying every major large language model in use today, including GPT-4, Claude, and Gemini. He is not speculating about AI from the outside. He helped build the technology he is now describing as a threat.

"We're facing an existential crisis in DeFi around the pervasive vulnerabilities in all code, accelerated by powerful LLMs, everywhere across the web," Polosukhin wrote in a May 2026 Substack post.

He elaborated on this in the same Substack series: "We will eventually need to formally verify everything."

How the Attack Pipeline Works

The mechanics are straightforward and increasingly accessible. Decompilation tools convert compiled smart contract code (EVM bytecode, for Ethereum-based contracts) back into human-readable form. An AI system then scans that output for known vulnerability patterns.

According to one estimate published by Nadcab.com, a blockchain development services firm, an attacker can run this process on a single contract for as little as $1.22. At that price point, scanning thousands of contracts simultaneously is economically trivial.

Between January and May 2026, AI-assisted attacks drained $36.7 million across five DeFi protocols, according to reporting by CryptoTimes. The largest single incident involved Truebit, where an integer overflow vulnerability was exploited for $26.2 million. The targeted contracts shared a common trait: they had not been formally verified and received limited scrutiny from security researchers.

This coincides with a broader surge in attack frequency. TRM Labs recorded 207 crypto hacking incidents in the first half of 2026, the highest count ever recorded in a single six-month period. Total losses reached $972 million. North Korea-linked actors were responsible for approximately $643 million of those losses, roughly 66 percent of the total, a figure that underscores the state-level sophistication now directed at crypto infrastructure.

Smart contract exploits accounted for 125 of those incidents, even though infrastructure-level compromises (such as private key theft and server breaches) still drove approximately 76 percent of total dollar losses despite representing a far smaller share of incidents by count.

Why Formal Verification Matters Now

Formal verification uses mathematical proofs to confirm that code does what its specification says it does, no more and no less. It has been an academic tool for years but is gaining commercial traction. Certora is among the leading formal verification platforms now available to developers. Tools such as Mythril (symbolic execution), Echidna (fuzzing), and Slither (static analysis) form a complementary security toolchain; they catch different classes of bugs through different methods but do not provide the mathematical proof guarantees that formal verification delivers.

Polosukhin's argument is that the investment is no longer discretionary: "Billions of AI agents entering financial systems soon will dramatically accelerate complexity," he has written, framing security infrastructure as existential rather than optional.

The same AI tooling driving attacks is also being deployed defensively. Research from MATS Research and Anthropic found that AI agents identified $4.6 million in smart contract exploits before they could be weaponized, and platforms such as Immunefi use AI-assisted scanning to front-run malicious discovery. The threat vector runs in both directions.

For users who are not developers, formal verification is a practical question worth asking before depositing funds. A protocol that has been formally verified has cleared a higher bar than one that has only been audited for common bugs. That distinction is becoming more consequential as automated exploit tooling spreads.

Regional Exposure Is Uneven

The threat does not land evenly across geographies. South Asia accounts for a significant share of the global freelance smart contract developer pool, according to industry estimates. Developers in India, Pakistan, and Bangladesh frequently build across multiple chains for international DeFi projects.

Two major Indian centralized exchanges suffered significant hacks in consecutive years: WazirX lost more than $230 million in 2024 through a multi-signature wallet compromise, and CoinDCX lost $44.2 million in July 2025 through a server-level breach suspected to involve tactics associated with North Korea's Lazarus Group.

Both incidents involved compromises at the infrastructure or key management layer rather than smart contract code flaws, but the pattern has sharpened regional attention to security.

Developers working on unaudited contracts now face a materially more hostile environment than they did even two years ago, a shift reflected in TRM Labs' record incident data for the first half of 2026.

In Sub-Saharan Africa, where on-chain transaction value exceeded $205 billion in the year ending June 2025, a 52 percent year-over-year increase per the Milken Institute (the most recent full-year figures available), DeFi participation is growing through stablecoin-based savings and payment applications. Stablecoins account for approximately 43 percent of all crypto transaction volume in the region, reflecting their practical role in everyday financial activity.

Many of those protocols operate with limited security budgets. The AI-automation of exploit discovery makes previously low-profile, lower-value-locked protocols viable targets in a way they simply were not before.

What Comes Next

NEAR, trading near $1.93 with a market cap of roughly $2.4 to $2.6 billion as of July 17, 2026, is building post-quantum-safe signing on testnet and developing SHIELD, a transaction-level analysis system. The protocol counts approximately 2,480 active developers and has distributed more than $45 million in grants to over 800 projects, providing useful context on its scale for readers encountering it for the first time.

Polosukhin has framed the problem as an industry-wide challenge, not merely a concern for his own protocol's roadmap.

If formal verification becomes a licensing requirement in jurisdictions such as Kenya, Nigeria, or South Africa, where crypto regulatory frameworks are actively developing, the incentive structure for developers could shift quickly.

For now, the incentive remains mostly risk-based. The cost of being wrong has dropped to $1.22 per scan on the attacker's side. The cost of getting it right starts with choosing to verify.