For several years I was responsible for the technical architecture of a protocol that held customer funds, custody included. The part of that job that kept me awake was never the transaction logic. It was withdrawal authority: who was able to sign, what they were able to sign, and how long anyone had to notice if a signature appeared that should not have existed.
Agents are now being handed that authority. Most of the discussion about it concerns the model, which is to say reasoning quality, output reliability and prompt injection. Those are real problems. The incident record from the past two years points at something more boring.
Distributed financial systems have been giving signing authority to automated processes for a long time, and what came out of that is a catalogue of failure classes. Most of them sit in the operations around the logic rather than in the logic itself: privileged administrative actions, conversions between one representation and another, external events that authorise internal changes of state. An agent with a wallet is a new holder of those problems, working fast enough that the window for noticing closes early.
Most of the money lost in 2026 left through operations
CertiK’s Hack3D report for the first half of 2026 counts $1.31 billion across 344 incidents. Code vulnerabilities account for 204 of those incidents and $151.6 million of the money. Wallet and key compromise accounts for 33 incidents and $444.5 million, which the report names the most costly vector of the period.
Code bugs were the most frequent way in and among the cheapest. Ronghui Gu, who co-founded CertiK, told Forbes in July that key compromise averaged more than $13 million per event, and that attackers “are getting more return by going after key management, multisig governance, and operational infrastructure”. His summary of the position: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.”
The total fell 46.8% against the first half of 2025, which sounds like improvement. The 2025 figure includes the $1.45 billion Bybit theft. Remove it and the comparable total for 2026 runs about 28% higher, over a period in which Immunefi logged 207 incidents, the most it has recorded.
An agent is a privileged account that can be talked into things
Gu’s formulation is the one I keep coming back to. An AI agent with wallet access, he says, is “essentially a new kind of privileged key holder”.
The qualifier that belongs with it is what changes the engineering. A person asked to approve something unusual may stop and ask why. Software acts on the input it was given, then acts on the next one, and an attacker who can shape those inputs is shaping the decisions.
There is already an example of this, and it is usually described wrongly. In June, jaredfromsubway.eth, among the better known automated trading operations on Ethereum, lost roughly 4,424 ETH. CertiK’s analysis sets out the sequence. The bot’s strategy granted ERC-20 approvals to wrapper contracts and assumed each allowance would be spent.
A coordinator contract caused the wrapper to skip its transfer step, so the allowance survived. The bot did not check whether approvals had been consumed and did not revoke the ones that had not. Sixty-six bait contracts were then activated together, sixty of them holding live approvals, and those did the rest. No model was involved anywhere in this; the strategy was arithmetic. The bot lost its money to permissions it had issued and stopped tracking.
Some administrative operations can remove their own undo
In late March 2026 Drift’s security council moved to a two-of-five signing threshold with no timelock. On 1 April the protocol lost between $285 million, the figure outside investigators use, and the $295.7 million Drift reports in its own recovery update. No contract bug was involved.
The investigators do not agree on the mechanism. Chainalysis describes a long social-engineering operation that ended with council members blind-signing transactions which transferred administrative control to an attacker address, and says it worked from Drift’s own account of events without verifying that account independently. TRM Labs adds a second element: a fictitious asset, CarbonVote Token, seeded with a few thousand dollars of liquidity and wash-traded into a price history near a dollar, which was then accepted as collateral. Both treat the removed timelock as material. Attribution points toward North Korea and has not been made formally.
Underneath the specifics is a design question that applies to anything with an administrative interface. Changing who holds authority over a system is itself an operation that system performs, and it can be written so that performing it leaves nobody able to reverse it. The condition worth enforcing is that a change to privileged access must be rejected when its result would remove the capability needed to undo it. Agent platforms will need this quite soon, because revocation is what every other control depends on, and in most implementations it is an ordinary privileged call.
A signature covers bytes, and the ledger spends a parsed structure
A signature authorises a sequence of bytes. The state transition that moves the money operates on a structure parsed out of them. When the component producing the bytes and the component consuming them disagree about how one maps onto the other, the signature attests to one instruction while the system carries out another.
The class is well documented. HTTP request smuggling is the same disagreement between a proxy and an origin server. DER was specified because two conforming decoders could read one encoding differently. In a settlement system the result is harder to live with than a bypassed check, because afterwards a divergence between what was signed and what executed looks identical to a user having authorised the outcome.
Agent architectures have this split by construction. A mandate gets composed in one place, serialised, carried across a protocol boundary and executed somewhere else, frequently by software written in another language by another team. Two things help. Make the encoding length-prefixed, so that no field boundary depends on context. Then pin the implementations against each other with a test that asserts byte-for-byte agreement across every transaction form the protocol accepts.
Assume the signing key is already gone
Most authorisation design begins from keeping a key out of the wrong hands. The designs that hold up begin from the assumption that it is already there.
Threshold signing spreads the problem across more people without removing it, and a threshold can be reached, which is what Drift showed. A cancellable delay on large or unusual operations adds the one thing a compromised key cannot take away, which is time to notice. It concedes in its own design that enough signing authority can eventually be obtained.
The same reasoning covers every point where something outside the system authorises a change inside it. An agent retrying a failed call, or an operator confirming that a bank payment arrived, should have that authorisation bound to a specific reference that the system records as consumed. Exactly-once then holds at the ledger instead of depending on the retry loop behaving.
None of this is new engineering. Timelocks, length-prefixed encodings and consumed references were written up long before anyone thought to give software a wallet. They are what I would want in place before an agent of mine was allowed to hold a key.
