How malicious AI agents attack web3 — and how to catch them

Of everywhere an autonomous AI agent can cause damage, web3 is the sharpest edge. The money is programmable, the transactions are irreversible, and an agent can hold a wallet and move funds directly — no human in the loop, no chargeback, no undo. If you're building on BNB Chain, Ethereum, Base or any EVM chain, a hostile agent is a threat model you can't ignore.

Why web3 is the perfect hunting ground

• Agents can hold wallets — an embedded wallet gives an agent direct control of funds, with no bank, KYC or human approval in the way.
• Transactions are final — once an agent drains or transfers, it's done. There's no reversal.
• Everything is public and composable — the mempool, contract code and balances are all readable, so an agent can scan for opportunities at scale.
• A fresh wallet looks clean — no history, no reputation, nothing for a fraud model to flag.

The attacks we actually see

Against on-chain bait, the behaviours that separate a hostile agent from an honest one are consistent. In controlled tests, decoy contracts that looked exploitable were taken far more often than ordinary contracts:

• Draining an "unguarded" vault — calling a withdraw function on funds that aren't theirs.
• Seizing ownership — calling setOwner or transferOwnership on a seemingly misconfigured contract.
• Chasing too-good-to-be-true yield — a weaker signal, since a legitimate yield agent might also engage, so we weight it lower.
• Using leaked keys — acting on a private key or seed phrase found in a decoy document or exposed file.

Why normal defences miss them

CAPTCHAs, rate limits and fraud models were built to tell a human from a bot. An agent passes straight through: it behaves like a careful user, arrives with a clean wallet, and trips none of the usual signals. By the time it shows up in your logs, the funds are gone.

How Norosha catches them on-chain

Instead of watching all traffic and guessing, we put out bait only a malicious agent would take — honeypot contracts that look drainable but hold only dust and are completely inert. Every interaction is recorded on-chain as tamper-proof evidence. We fingerprint the model family behind the behaviour, and link sightings that reuse the same wallet into a single actor, so you see the campaign, not just scattered alerts — and a clear action: block this wallet.

In web3, the money is programmable and the mistakes are permanent. That's exactly why an early warning — before an agent reaches your real contracts — is worth so much.

All of our bait runs on our own systems and contracts. We never access an attacker's machine, fake credentials are inert, and observed addresses are described as having interacted with bait — never as accusations about a person. Explore live on-chain detections on the public Attack Atlas.