Researchers from the University of California have uncovered a troubling new class of infrastructure-level attacks that pose a serious threat to cryptocurrency security. These attacks target AI agent routing layers, capable of draining crypto wallets and injecting malicious code into developer environments. Alarmingly, evidence suggests that such crypto thefts have already occurred in the wild.

A systematic study published on arXiv on April 8, 2026, titled “Measuring Malicious Intermediary Attacks on the LLM Supply Chain,” evaluated 428 AI API routers. The findings were staggering: 9 routers injected malicious code, 17 accessed AWS researcher credentials, and at least one free router successfully drained ETH from a researcher-controlled wallet.

The attack surface is the AI agent routing layer, a critical infrastructure that has rapidly evolved as AI agents become more integrated into blockchain workflows. The critical question now is not whether this threat is theoretical but how many compromised routers are currently managing live user sessions.

Key Findings from the Research

• Scale of Testing: Researchers tested 428 routers, including 28 paid routers sourced from platforms like Taobao and 400 free routers from public communities, using decoy AWS Canary credentials and encrypted crypto private keys.
• Confirmed Malicious Activity: The study confirmed that 9 routers injected malicious code, 17 accessed AWS credentials, and 1 free router drained ETH from a researcher-owned wallet.
• Evasion Sophistication: Two routers demonstrated adaptive evasion tactics, such as waiting 50 API calls before activating malicious behavior and specifically targeting YOLO-mode autonomous sessions.
• Attack Mechanism: The routers function as application-layer proxies with plaintext JSON access, meaning there are no encryption standards regulating what they can read or modify during data transmission.
• Poisoning Reach: Leaked OpenAI API keys processed 2.1 billion tokens, revealing 99 credentials across 440 Codex sessions and 401 autonomous YOLO-mode sessions.
• Recommended Defenses: The researchers advise implementing client-side fault-closure gates, response anomaly filtering, append-only audit logging, and cryptographic signing for verifiable LLM responses.

The researchers constructed an agent named “Mine” to simulate four distinct attack types against public frameworks, specifically targeting YOLO-mode sessions, where actions are executed without human confirmation. Notably, two of the routers tested displayed adaptive evasion tactics, demonstrating a sophisticated approach to avoid detection during initial testing.

Understanding the Threat

Malicious routers exploit the inherent trust model of standard LLM API infrastructure. These routers position themselves as application-layer proxies, gaining full read-write access to the plaintext JSON payloads exchanged between clients and model providers. Without encryption standards in place, a malicious router can access raw prompts, model responses, and potentially sensitive information such as private keys and API credentials.

Once compromised, these routers can alter responses before they reach the user, inject malicious code into generated outputs, or exfiltrate credentials to external endpoints. The scale of risk is amplified by the poisoning attack vector, as seen when leaked OpenAI API keys are processed through compromised routing infrastructure, leading to rapid exposure of sensitive credentials.

Who Is at Risk?

The vulnerability does not stem from the existence of third-party API routers but rather from the flawed trust model that assumes neutrality in the routing layer. Developers frequently use these routers to build on-chain tools and DeFi automation scripts, with many opting for free routers from public communities to minimize costs.

Existing wallet security measures—such as hardware devices and multisig setups—fail to protect against the interception of private keys by routers. As a result, users are left exposed to attacks that can occur silently and without warning.

Annual losses from crypto theft have already reached $1.4 billion. The emerging threat posed by these malicious AI routers does not require breaking cryptographic protections; rather, it exploits vulnerabilities in middleware that users typically overlook.

The researchers emphasize that YOLO-mode autonomous sessions present the highest risk, as they allow agents to execute transactions without human oversight, providing malicious routers with an extended window to exploit vulnerabilities unnoticed. The findings were further amplified by industry experts, highlighting systemic security vulnerabilities in third-party API routers relied upon by AI agents across DeFi tooling.

The researchers recommend immediate action to implement client-side defenses, including halting execution upon detecting anomalous responses and establishing cryptographic standards for LLM responses, paving the way for more secure interactions in an increasingly automated digital landscape.

Source: Cryptonews News