On Sunday morning, February 15, 2026, a governance proposal executed on the Moonwell lending protocol, and for a few minutes a certificate representing roughly $2,200 of Ethereum was priced at about $1.12.

The number was not an attack. It was a configuration. The proposal, MIP-X43, moved Moonwell's markets on Base and Optimism onto new Chainlink OEV price feeds. One market's oracle was wired to read the cbETH-to-ETH exchange rate alone — a ratio that sits near 1 — and treat it as a dollar price. The protocol briefly believed that Coinbase Wrapped Staked ETH, trading around $2,200, was worth about a dollar.

The trading bots needed less time than the response team. Repay a one-dollar loan, withdraw a whole unit of cbETH, repeat. By the time borrowing was frozen, bots had extracted what they could and the market carried roughly $1.78 million in bad debt, concentrated in the cbETH market on Base. Moonwell confirmed the mechanics in its own post-mortem, and coverage by Cointelegraph and others on February 18 turned the number into a headline.

Then came the detail that turned a routine DeFi incident into an industry argument. When the auditor Pashov examined the git history, he found that portions of the vulnerable oracle code had been co-authored by an AI model — commits attributed to Claude. Within days, "vibe coding" — accepting machine-generated code with little human scrutiny — had a cost figure attached to it, and the discussion about AI-written smart contracts stopped being hypothetical.

What Actually Failed

Precision matters here, because the bug was not exotic. Nothing about it required cryptographic insight or a novel exploitation technique. A unit conversion was missing — the same class of mistake an exhausted human engineer makes at two in the morning. The model did not invent a new vulnerability class. It produced code that compiled, read cleanly, and shipped with an unchecked assumption: that a ratio is a price.

That is the real finding, and it is worse than "AI writes bad code." The AI wrote code that looked finished. Every human checkpoint downstream — code review, the audit, the governance vote — saw plausible, idiomatic, well-organized Solidity and approved it. The flaw lived in an assumption between two systems, exactly where reviewers look least. Human error hides in complexity; machine error hides in plausibility.

Trained on the Typical, Deployed Into the Adversarial

A language model predicts what code usually looks like. A smart contract is a program that holds other people's money in public, forever, where anyone can call any external function with any input. Those are different requirements. The model optimizes for resemblance to its training data; the attacker probes the tail — the rare input, the unusual sequence, the assumption that holds in every example and breaks in production.

The pattern is measurable. In an experiment published by ContractScan in October 2026, researchers gave DeepSeek's API 24 plain-language requests for six common contract types, then ran static analysis over the output. Twenty-two of the twenty-four compiled. The tools confirmed two high-severity bugs — both reentrancy paths in the same contract. The code that failed was not the code that crashed; it was the code that worked, beautifully, right up until someone called it in an order the model had not seen in training.

The same study describes the bug classes that keep reappearing in AI-written Solidity: access-control checks that guard the happy path but not the reentrant one, oracle values trusted without decimals or staleness checks, upgrade hooks that anyone can call. None of these are exotic either. They are the predictable product of a system that writes the average of everything it has read.

The Bar Did Not Move

It would be convenient to blame the tool, but the money was leaving protocols long before models wrote their code. CoinGecko's 2026 State of Crypto Security report counts over $3.63 billion lost across 245 exploits since the start of 2025 — stolen keys, broken access control, flawed accounting. The OWASP Smart Contract Top 10 reads the same in 2025 as it did in any year: the bugs are old; the authorship is new.

What changed is where verification has to start. If code may be machine-written, then review against the code itself is circular — the model that wrote it can also write the tests that pass it, and a reviewer who reads only the diff inherits whatever assumption the model baked in. The spec has to come from somewhere else: an independent, human-owned description of what the system must and must not do, written before the first line of code. Then the audit compares behavior against that spec, not against the code's own tests.

Provenance helps too. Teams already track which commits came from which author; knowing which portions had AI assistance tells auditors where to spend their skepticism. And deployment discipline — staged rollouts, per-market value caps, automatic pauses on anomalous prices — converts the next misconfiguration from a nine-figure event into a monitored incident. Moonwell's losses stayed under $2 million partly because the bots were racing each other and the protocol could pause borrowing. A less liquid market would not have been that lucky.

Immutability Is the Multiplier

In normal software, a plausible-looking bug ships on Friday and gets patched by Tuesday, and nobody outside the team notices. A smart contract has no Tuesday. The code that goes live is the code that stays live, holding whatever it holds, for as long as anyone cares to attack it. Every shortcut in authorship is permanent.

None of this argues against writing code with AI. The productivity is real, and the model that co-authored Moonwell's oracle did not do anything a careless human contractor might not have done. The argument is about what verification means when the author is a machine: independent specifications, provenance tracking, adversarial review, and deployment systems that assume the code is wrong until reality confirms otherwise.

The tools will improve; the assumptions will not audit themselves. The protocols that survive the AI era will not be the ones that write code fastest. They will be the ones that treat every commit — human, machine, or both — as untrusted until it has survived contact with an adversary.