AI just bypassed the Cloudflare protection that DeFi needs

Despite launching countless branding exercises that feature the word “decentralization,” much of the crypto industry actually uses Cloudflare to defend large chunks of its user-facing infrastructure.

Indeed, Cloudflare protects crypto websites collectively processing billions of dollars worth of trades and receiving millions of visitors daily. However, this week, crypto learned that autonomous AI agents can apparently use an open-source library to walk right through several of Cloudflare’s lines of defense.

Most heard of the vulnerability from a headline about OpenClaw, an AI agent that runs on a Mac Mini or cloud server.

OpenClaws, formerly known as ClawdBots or MoltBots, can now use a free library called Scrapling to “bypass Cloudflare natively.”

“Scrape any website without getting blocked, with zero bot detection,” the developer wrote in a brief blurb on Github before releasing the code into the wild.

It soon rocketed to a #1 trending spot among Github repositories.

The age of homespun AI agents has arrived

Boasting concurrent, multi-session crawlers with realistic start/stop actions and proxy IP addresses, the Python library allows AI agents like OpenClaw and others to bypass “all types of Cloudflare’s Turnstiles and Interstitials.”

Not only that, its own benchmarks claim over 600 times the parsing speed of BeautifulSoup, a formerly impressive web crawler.

The age of homespun AI agents is here, and the traditional armor that crypto has employed to protect its websites against crawlers, spiders, Denial of Service (DoS) attacks, and hackers of all types is starting to crack.

Through the use of human-mimicking behavior and AI adaptation, an OpenClaw agent can trick sophisticated forms of bot detection. Even more devastatingly, it can operate on commodity hardware and volley attacks for a few cents.

DeFi keeps relying on Cloudflare while losing millions

Decentralized Finance (DeFi) has already learned — repeatedly and expensively — what happens when its Cloudflare-dependent front-ends fail.

Although it doesn’t have 1:1 similarity with the capabilities of Scrapling, the most obvious example of crypto’s reliance on Cloudflare remains BadgerDAO.

In December 2021, an attacker compromised a Cloudflare Workers API key.

The attacker used that key to inject a malicious script into BadgerDAO’s front-end, tricking users into signing token approvals. It drained $130 million.

Consider another example. Curve Finance suffered Domain Name System (DNS) hijacks in August 2022 and again in May 2025.

Each time, attackers accessed its registrar and redirected traffic away from Cloudflare’s nameservers to malicious clones.

The 2022 attack cost users over $500,000. The 2025 attack forced Curve to abandon its “.fi” TLD entirely and migrate to Curve.finance.