Anthropic's New Claude Models Arrive as DeFi Hack Losses Top $840M

Anthropic released Claude Fable 5 on Tuesday, the first public model in its Mythos class and, the company says, its most powerful yet. It shipped alongside a restricted sibling, Claude Mythos 5, available only to vetted users in cybersecurity and critical infrastructure. Experts say Mythos can find and chain zero-day vulnerabilities and help turn a raw bug into a working attack. The timing is grim. DeFi protocols have already lost more than $840 million to hacks in the first five months of the year, per DefiLlama, and April alone took more than $600 million, the worst month on record.

Anthropic built guardrails. The public model blocks the most dangerous requests, and when it detects a high-risk one it routes the session to a weaker model, Claude Opus 4.8. The company says that fallback fires in fewer than 5% of sessions, and that more than 1,000 hours of external bug-bounty work turned up no universal way to break the system. It also concedes the obvious. "The uplift from Mythos-level capabilities is valuable to many adversaries," it wrote, naming those who could profit from cyberattacks, "and we therefore expect them to be motivated to try to circumvent our safety measures."

What worries defenders is not novelty. It is speed. "Current AI guardrails raise friction," said Charles Guillemet, chief technology officer at hardware-wallet maker Ledger. "They are not a reliable control against a determined adversary." A reasoning model can "diff every commit, grep every config, and enumerate every misconfiguration at machine speed," he said. Crypto is unusually exposed because a software failure turns into a financial loss almost at once.

But the biggest hits this year did not come from contract bugs. A North Korea-linked group drained about $285 million from Drift Protocol after a six-month social-engineering campaign that won it admin access. An attacker siphoned roughly $292 million from Kelp DAO through a single-verifier flaw. On Tuesday, Humanity Protocol lost over $30 million after a hacker reached three of six private keys on one employee's laptop. A model like Fable does not need to hand over a finished exploit to shift the math. It can read public repositories, compare old software versions, and draft messages that hunt for the operational mistakes humans miss.

The same tools defend. Pendle, a DeFi yield protocol, says it has used Anthropic's models since the first Claude Opus to map its code and stress-test contracts, including freshly deployed ones. Its developers argue smart contracts are the wrong worry. A contract is short, with maybe a dozen entry points, small enough for a good auditor to hold in their head. "There are really not that many lines of code in a smart contract to audit," the team said. Which is why the next big crypto hack will probably not look new. It will look like the same poisoned package, fooled developer, or bad signing flow DeFi already knows.