Key takeaways
- Arbitrum has paused new Stylus contract activations, with reporting citing AI-assisted attack risks. Existing contracts continue to run and renew.
- Separately, Chainalysis reports that AI compressed the tracing of the $387 million Bitget theft from roughly 20 hours of bridge analysis to under 10 minutes.
- Both offence and defence became faster at the same time, and the two are not symmetrical: finding a flaw only has to work once, while tracing happens after the money has already moved.
- NEAR Intents reports recovering the entire $3.8 million taken in its exploit after issuing a public ultimatum, which is the resolution of a story we covered twice.
- The practical implication is about time: the window between a vulnerability existing and somebody finding it is getting shorter, which makes pause capability and audit recency more important rather than less.
Two stories this week describe the same development from opposite directions, and reading them together is more useful than reading either alone.
Arbitrum has paused new Stylus contract activations. Reporting attributes this to AI-assisted attack risks, with existing contracts continuing to run and renew. Yesterday this was described simply as an emergency security action; the stated reason is more specific and more interesting.
Separately, Chainalysis reports that AI compressed the tracing of the $387 million Bitget theft from around 20 hours of bridge analysis to under 10 minutes.
So the tools for finding flaws and the tools for following stolen funds both got substantially faster, at roughly the same moment. That sounds like a wash. It is not, and the asymmetry is the part worth understanding.
Why these two speedups are not equivalent
Finding a vulnerability is a search problem. You examine code, look for a mistake, and you only need to succeed once. Anything that makes that search faster or cheaper increases the number of flaws found per unit of effort, across every contract that exists.
Tracing stolen funds is a reconstruction problem, and it happens afterwards. The money has already left. Faster tracing improves the chance of attribution and of freezing what remains freezable, which is genuinely valuable and is a different thing from prevention.
We covered what recovery actually involves: the funds are visible on-chain, and whether they are reachable depends on whether they sit in something an issuer or exchange can freeze. In the Bitget case, reporting indicated only about $318,000 of $387 million was still freezable. Tracing faster would not have changed that arithmetic much.
So one side got faster at creating losses, and the other got faster at describing them. Both matter. They do not cancel.
What Arbitrum's pause actually tells you
Pausing new activations while assessing a risk is the responsible action, and it deserves saying plainly. A team that can halt a category of deployment in response to a credible concern is better positioned than one that cannot.
It is also a demonstration of exactly the property we have been pointing at. Somebody holds the ability to pause part of a layer-2. That capability is being used well here, and it exists regardless of how it is used.
That connects directly to the questions worth asking about any of these systems: who can change or halt something, how quickly, and what notice you get. The answer in this instance is reassuring. The point is that the question has an answer at all, and that you should know what it is for anything holding your assets.
The part that affects how you assess an audit
We have made the case that an audit establishes that experienced reviewers did not find certain problems within a defined scope, not that a contract is sound.
If the cost of searching for flaws is falling, that distinction becomes more consequential rather than less. A review completed two years ago was conducted when finding a particular class of bug required a certain amount of expert time. If that time has materially decreased, the same code is now exposed to a larger number of searches than it was when it passed review.
That is not a claim that audits are worthless. It is a reason to ask when a review was done, not merely whether one exists. Recency has acquired a meaning it did not clearly have before.
NEAR Intents: the full recovery
Following the exploit and the 48-hour ultimatum we covered, reporting indicates NEAR Intents has recovered the entire $3.8 million, with a published Bitcoin recovery wallet receiving about 34.59 BTC.
Full recovery is the best available outcome and the public-negotiation approach worked here. It is worth noting why it can work: converting a large stolen holding is genuinely difficult when addresses are being watched and issuers can freeze tokens. Pressure is sometimes enough.
It is also worth keeping the base rate in mind. This approach succeeds sometimes, and the Bitget case — a far larger amount, attributed in reporting to a state-linked group — produced a recovery of a fraction of one percent. Which outcome you get depends heavily on who took the funds and what they can do with them, neither of which is in your control.
What to actually do with this
Three things, none of them dramatic.
For anything holding meaningful value, find out whether a pause capability exists and who holds it. This week shows that capability being used protectively, which is the argument for knowing whether it is there.
Check when the code you depend on was last reviewed, not just whether it was. If searching for flaws is getting cheaper, a review's age is now part of its meaning.
And revisit your approvals. This remains the most consequential thing within your direct control, and it is unaffected by any of the above. An unlimited permission granted to a contract years ago is exposed to every flaw found in it since, including the ones found faster.
The market
Bitcoin is around $85,300, up roughly 0.7% over 24 hours and about 0.4% over the week. Ether is near $2,700. Total market capitalisation is approximately $2.89 trillion. The Fear and Greed Index reads 65, in its greed range. These are current conditions and we make no claim about direction.
The point
Offence and defence both accelerated this week, and they are not symmetrical. Finding a flaw needs to work once; tracing happens after the money has gone.
The practical consequence is about time. The interval between a vulnerability existing and somebody finding it appears to be shortening. That makes the ability to pause, the recency of a review, and the permissions you have already granted more important than they were, not less.
Frequently asked questions
What did Arbitrum actually pause, and should I be worried?
Reporting says it paused new Stylus contract activations, citing AI-assisted attack risks, while existing contracts continue to run and renew. Pausing in response to a credible concern is the responsible action rather than a warning sign. The useful takeaway is that the capability to pause exists and somebody holds it - which is worth knowing for any system holding your assets.
If AI makes tracing faster, does that mean stolen funds get recovered?
Not reliably. Tracing establishes where funds went, which helps with attribution and with freezing whatever is still in a freezable form. In the Bitget case reporting indicated only around $318,000 of $387 million remained freezable. Faster tracing improves the description of what happened more than it improves the chance of getting funds back.
Why are faster attacks and faster tracing not symmetrical?
Finding a vulnerability is a search that only has to succeed once, and cheaper searching means more flaws found across every contract that exists. Tracing is a reconstruction that happens after the money has already moved. One side got faster at creating losses; the other got faster at describing them.
Does this mean audits are now worthless?
No. It means the age of an audit has acquired a meaning it did not clearly have before. A review establishes that experienced people did not find certain problems within a defined scope at a point in time. If the cost of searching for flaws is falling, code that passed review two years ago is now exposed to more searching than it was then. Ask when, not just whether.
What is the single most useful thing I can do about any of this?
Review and revoke old token approvals. It is entirely within your control, it takes minutes, and it is unaffected by how fast anybody's tools are getting. An unlimited permission granted to a contract years ago remains exposed to every flaw found in that contract since - including the ones found more quickly now.
Did NEAR Intents really get all the money back?
Reporting indicates the full $3.8 million was recovered after a public 48-hour ultimatum, with a published recovery wallet receiving about 34.59 BTC. Public negotiation can work because converting large stolen holdings is difficult when addresses are watched. It does not always work - the outcome depends substantially on who took the funds.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.