The cryptocurrency industry is racing toward a future where AI agents will handle everything from booking flights to executing transactions and making payments, but new research suggests the infrastructure supporting that shift may not be secure.
McKinsey recently projected that AI agents could mediate between $3 and $5 trillion in global consumer commerce by 2030.
Coinbase founder Brian Armstrong said on X that “very soon” there will be more AI agents than humans transacting on the Internet. Binance founder Changpeng Zhao went bolder, predicting that agents will make a million times more payments than people, all in cryptocurrency.
But a group of security academics and cryptography researchers have published a paper explaining that a largely overlooked piece of AI infrastructure is already being used to steal credentials and even empty crypto wallets.
The authors of the articles are researchers affiliated with the University of California, Santa Barbara, the University of California, San Diego, the blockchain company Fuzzland, and World Liberty Financial.
Powerful attack points
The team found that so-called “LLM routers,” or services that sit between users and AI models, can act as a powerful attack point exploited by malicious actors. These routers are designed to forward requests to models like OpenAI or Anthropic, but they also have full access to everything that passes through them, including sensitive data.
“LLM agents have moved beyond conversational assistants to systems that book flights, run code, and manage infrastructure on behalf of users,” the researchers wrote, highlighting how quickly these tools are taking on real-world financial and operational tasks.
LLM routers or attack points leave users extremely vulnerable because they assume they are interacting directly with a trusted AI model like OpenAI, Grok or another, when in reality many requests pass through intermediary services that can view and modify that data, the researchers said.
According to one of the researchers, Chaofan Shou, the problem is no longer theoretical. He wrote on
“A malicious router can replace a benign command with one controlled by an attacker or silently exfiltrate every credential that passes through it,” the researchers wrote.
The researchers said that because these systems can operate autonomously, including frequently approving and executing actions without human review, a single altered instruction can immediately compromise the systems or funds.
For cryptocurrency users, the implications are serious, as private keys, API credentials, and wallet access tokens often pass through these systems in plain text. The researchers found multiple cases where routers simply collected those secrets, the article reveals. In one case, a test Ethereum wallet was emptied after its private key was exposed.
“Once exposed, credentials such as private keys can be copied and reused without the user’s knowledge,” the paper’s authors noted.
Cascading risks
The team also showed how easy it is to expand the attack. By “poisoning” parts of the router ecosystem, essentially tricking services into forwarding traffic, they were able to observe and potentially control hundreds of downstream systems in a matter of hours.
“A single malicious router in the chain is enough to compromise the entire system,” the researchers wrote, underscoring what they describe as a weakest link problem.
That suggests a cascading risk that even if a user trusts their AI provider, the intermediate infrastructure may not be trustworthy, they stated in their paper.
That creates a potential mismatch as industry leaders increasingly predict that AI agents will handle an increasing proportion of crypto activity, while the underlying infrastructure still lacks guarantees that the results have not been manipulated, they added.
