On March 2, 2025, a series of 47 transactions caught my eye. Each one called the same vulnerable smart contract on Ethereum mainnet, followed by a transfer of 0.5 ETH to a freshly created wallet. The pattern was too clean, too consistent. This wasn't human fatigue. This was an agent: the first known AI-executed ransomware attack.
The alert came from a security firm called Axion Labs. Their report claimed an AI agent autonomously scanned a DeFi lending protocol, exploited a known logic flaw, encrypted sensitive user data off-chain, and demanded a ransom in ETH. The human operators 'had not left the building,' but the trigger was pulled by code that learned.
But the ledger doesn't forget. I pulled the transaction data from Etherscan and my own indexed node. Let the data speak.
The On-Chain Signature
I analyzed the 47 transactions from the attack wallet (0x3f7...). The call data was identical in structure: a fixed 68-byte length with the same function signature, 0x9b3b, used repeatedly. The gas limit was set to exactly 120,000 wei for every single call. No human adjusts gas limits with such precision across 47 tries—especially not during a ransom negotiation. The pattern screamed automation.
But automation is not autonomy. I traced the smart contract deployment. The agent created a factory contract that spawned child contracts for each victim. The factory was deployed from a wallet funded by a known human-operated exchange deposit—Binance, 15 days prior. The seed for the random number generator used inside the encryption logic was hardcoded in the bytecode, not generated on-chain. A truly autonomous agent would have used a blockchain oracle or a timestamp. This was a pre-planned backdoor.
The Hidden Cost of AI Efficiency
Using my 2020 DeFi stress-test engine, I simulated the agent's behavior under varying network congestion. The agent always chose the same sequence of operations: first, call withdraw() with a crafted calldata to trigger the reentrancy bug; second, call encryptData() on an off-chain endpoint (IPFS hash logged); third, emit an event with the ransom demand. The IPFS hash pointed to a static text file, not a dynamic negotiation template. The agent had no ability to adjust ransom amounts or respond to victim communication. It was a script dressed in an LLM.
This matters because the narrative of 'autonomous AI threats' is dangerous. It creates panic and drives misallocated investments. The real risk is not a Skynet-like entity; it's the industrialization of attack scripts. The cost of running this agent? I calculated: 47 transactions at 120,000 gas each, plus LLM inference costs (likely <$50 for GPT-4o-mini via leaked API keys). Total outlay: under $500. Compare that to a manual pentest team charging $20,000 for the same exploit. The cost curve is collapsing.
The Contrarian: Correlation ≠ Causation
Axion Labs proudly titled their report 'First AI-Executed Ransomware Attack.' But I found that the agent's decision nodes—vulnerability selection, encryption key storage, payment address setup—were all pre-configured by a human operator. The agent only executed a fixed playbook in a randomized order. The 'AI' part was a thin wrapper around a probabilistic state-machine. The corpse of causation is still warm with human fingerprints.
In 2017, I audited Kyber Network's liquidity pool and found an integer overflow. The developers fixed it. Here, the vulnerability was known (CVE-2024-31289 in the lending protocol's flash loan logic) for six months. The agent didn't discover it; it was fed the exploit by its human masters. The 'first AI attack' is really the first widely publicized case of using an LLM as a macro recorder for a script kiddie.
What is new is the behavioral camouflage. The agent varied its transaction parameters slightly to evade signature-based detection. For example, it alternated between using msg.sender and tx.origin to confuse monitoring. This is a step up from static scripts, but still far from adaptive intelligence.
The Takeaway
Over the next week, watch for similar patterns on L2 chains (Arbitrum, Optimism). The agent's factory contract leaves a unique footprint: a CREATE2 opcode with a deterministic salt that derives from the deployer's wallet nonce. I've built a simple indexer for it. If you see a contract created with a nonce of 0xdead and a bytecode hash of 0xa1b2...c3d4, you're looking at a copycat. The math is silent until it screams.
The first AI ransomware attack is a milestone, but not a tipping point. The ledger shows a puppet, not a player. The real shift is economic: attacks are becoming cheaper, faster, and more accessible. That is the data story the headlines forgot to tell.