Critical Vulnerability in AI Coding Tools Poses Risk to Your Crypto

Blockchain security firm SlowMist has raised an urgent alarm about a serious flaw in AI-based coding tools. This vulnerability could put developer systems at risk with just a few simple project operations, highlighting the potential dangers for those in the cryptocurrency space.

Key Takeaways

SlowMist warns of a vulnerability in AI coding tools jeopardizing crypto developers' assets.
The flaw activates during routine actions like “Open Folder,” exposing systems without additional user consent.
A targeted attack method using hidden markdown instructions can lead to malware spread.
Cybersecurity threats from nation-state hackers are evolving, with instances of blockchain being used for malware distribution.
AI systems are being exploited to uncover zero-day vulnerabilities, increasing the risk of crypto scams.

Your Crypto Could Vanish: SlowMist Reveals Critical Flaw in AI Coding Tools

The flaw affects popular integrated development environments (IDEs) and poses significant threats to crypto developers, many of whom store valuable digital assets and sensitive credentials on their systems.

When users of AI coding assistants open untrusted project directories, they are in immediate danger. SlowMist’s threat intelligence team has noted that several developers have already fallen victim to this flaw.

AI Coding Tools as a Gateway to Crypto Theft

The vulnerability reported by SlowMist is especially dire for users of Cursor, as first documented by cybersecurity firm HiddenLayer in their research on the "CopyPasta License Attack." This exploit manipulates AI assistants by embedding malicious commands in visible developer files, such as LICENSE.txt and README.md. Such instructions are concealed in markdown comments and are not rendered in standard views, allowing AI tools to spread malware throughout large codebases.

According to HiddenLayer, attackers may create backdoors, steal sensitive information, or manipulate vital systems while the harmful code remains hidden. Their tests using Cursor and other affected tools—like Windsurf, Kiro, and Aider—demonstrated how minimal user interaction can lead to wide-scale code corruption.

This warning has surfaced following Coinbase CEO Brian Armstrong’s ambitious push to use AI-generated code for 40% of the company’s output, aiming for 50% by October. This has incited criticism from security experts and developers, who view it as a significant risk for any security-sensitive enterprise.

Nation-State Hackers Use Blockchain for Malware Distribution

Developers are grappling with organized cyber attacks, particularly from North Korean actors. These attackers have heightened their efforts by embedding malware directly into blockchain smart contracts—a first for nation-state usage of "EtherHiding" techniques.

Operatives from Chollima have employed malicious JavaScript modules to combine different types of malware, distributing them via fake job interviews designed to ensnare crypto developers. Google reported that North Korean group UNC5342 has integrated JADESNOW and INVISIBLEFERRET malware into smart contracts on the BNB Smart Chain and Ethereum since February, establishing a decentralized command-and-control system that is difficult to dismantle.

The techniques leveraged allow perpetrators to store harmful payloads on public blockchains through read-only function calls, evading transaction fees while leaving no visible history. In April, it was discovered that attackers were creating legitimate U.S. companies using stolen identities, with findings revealing fronts like Blocknovas, registered to an empty lot in South Carolina, and Softglide traced back to a tax office in Buffalo. Both were part of a broader “Contagious Interview” campaign distributing malware through technical assessments.

Despite crypto-related losses from hacks decreasing 60% in December to $76 million, down from $194.2 million in November, the threat landscape remains alarming.

AI Systems Identifying Zero-Day Exploits Worth Millions

The ethical implications of AI's use in cybersecurity are increasingly troubling. Research from Anthropic last month revealed that AI agents identified successful exploits in 50% of smart contracts during their SCONE-bench testing, simulating attacks that could be worth $550.1 million across 405 compromised contracts.

AI models like Claude Opus 4.5 and GPT-5 were able to find exploitable vulnerabilities in contracts deployed after their knowledge cutoffs, amounting to $4.6 million in value, including two zero-day exploits within live Binance Smart Chain contracts worth $3,694 against an API cost of $3,476.

The study highlights a concerning trend where potential exploit revenue roughly doubles every 1.3 months, along with decreased costs for generating successful attacks, posing a greater risk as AI models become more sophisticated.

Crypto AI Coding Tools - Percentage increase in gen-AI-enabled scam reports on Chainabuse Chart

Furthermore, AI-driven crypto scams surged by 456% from May 2024 to April 2025, according to Chainabuse data. Disturbingly, 60% of deposits into scam wallets were linked to AI-driven schemes utilizing deepfakes, voice cloning, and automated bots to create realistic conversations and fake identities.