"Pennies": Why Security Leaders Think the Billion-Dollar Hacks Are the Warm-Up

The warning, delivered through The Block by a group of industry security leads, is blunt: as autonomous AI agents mature, today's billion-dollar annual hack totals could "look like pennies." Behind the quote sits a number — TRM Labs tracks AI adoption across crypto crime up roughly 40% year over year.

The economics explain the alarm better than the rhetoric does. Historically, sophisticated attacks were constrained by sophisticated attackers: there are only so many people who can reverse-engineer a bridge contract or grind through wallet firmware. Agents dissolve that constraint. An exploit technique, once discovered, becomes software that runs against every eligible target simultaneously, around the clock, at the marginal cost of compute.

We've already seen the shape of it

This month's Coldcard drain was a preview: no phishing, no contact with victims — just patient, automated brute-force against a weakened keyspace, run at scale. Nothing about that operation required a human in the loop after setup. The same logic applies to scam conversations, which agents can now hold by the thousand, and to on-chain monitoring for exploitable deployments the moment they go live.

What the index actually measures

The 40% figure comes from TRM's 2026 AI-in-Crime Adoption Index, published August 17, which scores how far AI has penetrated each category of crypto crime rather than counting incidents. The composite sits at 54 out of 100 — "emerging" — against roughly 28 in 2024. Criminal AI adoption, on this measure, doubled in two years.

The category breakdown is the useful part, because the categories are not moving together.

Scams are the only category rated mature, and they are mature because AI now covers nearly the entire operation — building target lists, writing the lure, holding the conversation, and sustaining it. The evidence is in the loss data: reported deepfake-scam losses in 2026 to date already exceed the whole of 2025 by 263%, and the share of scam reports where AI was genuinely part of the scam has grown roughly thirteenfold since 2022.

Ari Redbord, TRM's global head of policy and government affairs, put the mechanism more precisely than the "pennies" line does: "AI has not invented new crimes. It removed the constraints on old ones. The skill floor collapsed." Ryan Kirkley, CEO of Global Settlement Network, gave the operator's version in eight words: "Now I can have an agent that goes after everyone."

The tooling has prices now

What separates this index from a forecast is that the criminal supply chain has retail pricing. No-code ransomware kits sell for $400 to $1,200. Ransoms in what TRM calls "vibe-hacking" operations — attacks run largely by an AI coding agent on behalf of someone who could not have run them alone — land between $75,000 and $500,000-plus in bitcoin. In early July 2026 researchers documented JadePuffer, which TRM describes as the first fully agentic ransomware, handling reconnaissance through encryption without a human driving. "This is the shape of attacks at scale against hospital systems and critical infrastructure," Redbord said.

On hacking, the index counts 201 separate hacks in the first half of 2026, more than double the 83 in the same period a year earlier. That figure sits slightly below the 207 in TRM's H1 report, which this desk covered; the firm has not explained the gap, and the likeliest reading is a differing cutoff rather than a correction. Either count supports the same point, and one further finding cuts against the panic: roughly 4% of incidents drove about 75% of the losses. Volume is climbing much faster than severity.

Related Your patch deadline was set by a machine

The half the index does not measure

TRM's index scores AI as a criminal capability — what attackers can now do with a model. It does not score AI as a criminal target, and in the weeks since publication that second column has been filling in faster than the first.

The reason is that agents need somewhere to run. In practice that means a gateway: a proxy sitting between the model and everything it is allowed to touch, holding the provider API keys, the routing rules, and increasingly the tool definitions themselves. Censys found internet-exposed AI and LLM tooling up more than 60% over nine months, reaching more than 294,000 public IP addresses. That is not a count of agents. It is a count of front doors.

Those doors are now being walked through. CISA added a command-injection flaw in the AI gateway LiteLLM to its Known Exploited Vulnerabilities catalog on June 8, after Horizon3.ai researchers demonstrated it chained with a Starlette host-header bug into unauthenticated remote code execution — enough, in Horizon3's description, to read model-provider credentials and stored API keys and pivot into connected infrastructure. On September 2 CISA added a second LiteLLM flaw, an authentication bypass on the Model Context Protocol endpoint, which this desk covered separately. Microsoft's security team spent late August making the same argument at length: AI gateways have become control points, and control points get attacked.

This matters for the index's core claim rather than beside it. The "pennies" warning assumes the agent is the weapon — a tireless attacker running one technique against every target at once. But an agent holding delegated authority over funds is also a target with unusually good loot, and it fails differently from a wallet. Compromising a private key gets an attacker one set of keys. Compromising the gateway an agent runs on gets them the whole permission set that agent was granted, and does it without touching a chain, triggering a contract, or generating a single on-chain signal for the monitoring tools in the next section to catch.

Both stories are true at once, and they compound: the same year that agents became capable enough to attack at scale, the infrastructure delegating money to them became worth attacking. The index measures one blade of that. The KEV catalog is quietly measuring the other.

Defense is racing the same direction

The counter-argument, made by the same people issuing the warning: defenders get agents too. Automated monitoring flagged this month's LayerZero delegate abuse within hours; firms like TRM and Blockaid are effectively betting their businesses on machine-speed defense. The open question is asymmetry — attackers need one hole, defenders need to watch everything.