SKN | Malicious AI Routers Found Capable of Stealing Crypto Wallet Keys

Hidden Risks in AI Infrastructure

Researchers from the University of California have identified a major security vulnerability in AI infrastructure, specifically involving third-party LLM routers. These systems, which act as intermediaries between applications and AI models, can access and process sensitive user data, making them a potential attack surface for cybercriminals targeting crypto users and developers.

How AI Routers Become Attack Vectors

Many AI applications rely on routing systems that connect requests to providers like OpenAI, Anthropic and Google. Because these routers terminate secure connections, they can view data in plaintext, meaning any sensitive information—such as private keys or seed phrases—can be intercepted if the router is compromised or malicious.

Evidence of Active Exploits

In testing hundreds of routers, researchers found multiple cases of malicious behavior, including code injection, credential harvesting and unauthorized access to cloud services. In one instance, attackers were able to drain Ether from a test wallet, proving that these vulnerabilities are not theoretical but can lead to real financial loss.

Developers Face Elevated Risk

Developers using AI tools to write smart contracts or manage crypto infrastructure are particularly exposed to this threat. By sending code, credentials or wallet data through AI systems connected to untrusted routers, they may unknowingly leak sensitive information that could later be exploited by attackers.

The Danger of “YOLO Mode”

The researchers also highlighted the risks associated with “YOLO mode,” a feature that allows AI agents to execute commands automatically without user confirmation. If a malicious router injects harmful instructions, this mode could allow those actions to be carried out instantly, increasing the likelihood of unauthorized transactions or system compromise.

Hard to Detect, Easy to Exploit

One of the most concerning aspects of the discovery is how difficult it is to detect malicious routers. Even previously legitimate services can become compromised, while free or low-cost routers may intentionally act as traps to collect valuable user data under the guise of providing convenient access.

Security Implications for Crypto Users

The findings highlight a growing intersection between AI and crypto security risks, emphasizing the need for stronger safeguards when using AI tools in financial or blockchain-related workflows. Users and developers should avoid sharing sensitive credentials through AI systems, rely on trusted infrastructure and maintain strict operational security practices to protect their digital assets.