AI models are keeping crypto hack narratives alive far longer than the fixes that followed them, according to an ICODA study published in its November Crisis Memory series. The research examined 296 responses from ChatGPT, Perplexity, Claude, and Gemini about five crypto brands with incidents ranging from one month to six years old. It found that 20 months after Bybit's February 2025 $1.5 billion SafeWallet compromise, all 12 answers to 'Is Bybit safe?' named the hack, and 11 put it first. Only eight mentioned the recovery, usually in a single clause after the theft. The study noted that Kelp DAO's April 2026 rsETH bridge exploit appears in 92% of neutral answers, but only one in four answers says holders were repaid in full.
The recent Binance theft looms over the study as the new record-holder. On 29 October 2026, attackers took about $6.3 billion from Binance, surpassing Bybit's earlier $1.5 billion loss and becoming the largest crypto hack on record. ICODA did not include Binance in its five-brand measured set because the event was too recent, but warned that every user asking 'Is Binance safe?' now gets an AI answer shaped by that incident, keeping reputation pressure on Binance and its BNB ecosystem. The research also found that models sometimes skip search and rely on outdated training memory: Gemini answered 29 of 45 neutral questions without search, none of which mentioned a hack, and one incorrectly stated Bybit had 'never suffered a major centralized wallet hack.'
ICODA's four-step guidance for crypto PR and security teams is to ask AI engines the same questions users ask, place the fix in the same sentence as the hack, give the recovery a dated page with third-party coverage, and not wait for old incidents to fade. 'A post-mortem closes a hack for the team. It doesn't close it for an AI engine,' said Anastasia Shalepina, AI SEO Expert at ICODA. 'The engine quotes whatever sentence is easiest to lift, and for most brands that sentence is the one about the theft.'
Separate security and market data reinforce why hack memory and diversification matter. Chainalysis data published in December 2025 showed cryptocurrency hack losses reached approximately $3.4 billion in 2025, the highest since 2022, with the Bybit incident accounting for about 44% of annual theft. SlowMist recorded roughly 200 security incidents in 2025, down from 410 in 2024, while average losses per incident nearly tripled to about $15 million. Access control exploits drove 59% of first-half 2025 losses, according to Hacken, while North Korean hacking groups stole $2.02 billion during the year.
Market volatility compounded those security risks. Bitcoin fell approximately 54% from its $126,198 all-time high to around $58,035 in June 2026. Memecoins such as PEPE and WIF also declined sharply from peak valuations. The analysis argues single-asset concentration magnifies crash losses, and illustrates a 60/30/10 allocation framework: 60% Bitcoin, 30% Ethereum, and 10% higher-risk alternative digital assets. It also describes stablecoin reserves, the Kelly Criterion for position sizing, and periodic rebalancing as tools for reducing exposure to individual asset failures, exchange outages, and custodial breaches. The key takeaway is that neither AI memory nor market losses fade on their own; both require proactive risk and reputation management.
