The logic held until the oracle blinked.
Last week, a DeFi protocol lost 40% of its liquidity providers in seven days. The official postmortem blamed a “flash loan attack vector overlooked in the audit.” But the real story was buried in the transaction logs—a mismatch between the TWAP oracle update frequency and the liquidation threshold. I didn’t need a formal report to see it. I needed to talk it out.
I spent ten minutes rambling into my phone—voice notes about liquidity depth, block timing, and that feeling that something was off. Then I fed that messy audio to an AI model. It asked four clarifying questions. Within another five minutes, it had structured the entire attack vector: the flash loan drained the pool, the oracle didn’t blink fast enough, and the code remembered what the whitepaper forgot.
This is not magic. This is Andrej Karpathy’s “long-form verbal prompt” method applied to blockchain forensics. And it terrifies me—not because it works, but because it works too well, hiding the fragility beneath the convenience.
Context: The Noise Before the Signal
Karpathy, former OpenAI founding member and now at Anthropic, recently shared a workflow: instead of crafting precise written prompts, talk for ten minutes in a chaotic, jumping manner—then let the model ask questions and reconstruct your true intent. The method leverages voice input’s speed (150 words per minute versus 40 for typing) and reduces cognitive load. It shifts the burden from the user’s prompt engineering skills to the model’s ability to infer, clarify, and structure.
In the blockchain world, we on-chain detectives are drowning in data. Transaction graphs, event logs, token flows, governance proposals—the signal is buried under terabytes of noise. Traditional prompt engineering for AI-assisted analysis requires us to formulate precise queries: “Find all transfers from address X to uniswap pairs between block Y and Z where the amount exceeds 1000 ETH.” That works, but it assumes we already know what to look for. The real skill is not in the query—it’s in the hypothesis generation.
Karpathy’s method addresses exactly this bottleneck. By verbalizing our hunches, doubts, and even false starts, we offload the pattern-matching to the model. It becomes a thinking partner, not a search engine. For an industry where speed can mean millions in lost or saved funds, this is tempting.
But blockchain is not a general knowledge domain. It is a world of deterministic state machines, immutable records, and adversarial incentives. What works for creative brainstorming may catastrophically fail for forensic accuracy.
Core: The Systematic Teardown of Verbal Forensic Prompts
1. The Model’s Assumption Problem
When I voice-chaos about a suspicious token transfer, the model has to reconstruct my intent from fragments: “...so the deployer wallet funded three new addresses each then bought the token and then maybe a rug? but the liquidity was locked...” The model might correctly infer I want to trace the deployer’s funding pattern. But it might also fill gaps with pleasant-sounding assumptions.
Example from my Terra-Luna post-mortem: I once asked a model to “explain why the UST peg broke.” The model gave me a textbook answer about bank runs. That was wrong. The real cause was a mathematical instability in the mint/burn mechanism under >0.5% daily volatility. The model’s reconstruction of my vague question was plausible but inaccurate. A precise prompt that specified “show the differential equation of the seigniorage mechanism” would have avoided the hallucination.
In verbal prompts, the model’s reconstruction is a black box. You cannot audit its reasoning because you never see the intermediate steps. Solidity does not lie, it only omits. The model omits the parts it cannot fit into a coherent narrative.
2. The Oracle Blink Problem
Karpathy’s method relies on the model asking clarifying questions. That is an Agent-like behavior—the model must identify information gaps and request fleshing out. In my tests using this method for on-chain analysis, the quality of those questions varied wildly.
Test case: I gave a verbal description of a recent exploit—the $1.2M flash loan attack on a lending protocol. I said: “they manipulated the oracle but not directly the price feed maybe the update delay.” The model asked: “Do you mean the oracle was lagging behind the spot price?” Correct. But when I described a complex governance attack on a DAO—a series of proposals that changed quorum thresholds—the model asked: “Was the attacker a whale or a group of coordinated addresses?” That was irrelevant. The real question should have been: “Did the proposal timing align with a decrease in voter participation?”
The model’s questions are only as good as its understanding of the domain. For blockchain, most general-purpose models lack deep knowledge of specific DeFi mechanics, consensus edge cases, and regulatory traps. The model asked the wrong question, and I didn’t realize until I wasted two hours following a dead end.
Signature: Entropy finds its way through the gap.
3. The Context Window Limit and Cost
A ten-minute voice note at 150 wpm yields about 1,500 words. But the model’s internal processing includes not just that text, but also its own generated questions, your responses, and any retrieved on-chain data. The total context for a single investigation session could easily exceed 10,000 tokens. On top of that, the model might need to access blockchain RPC data—fetching block logs, transaction receipts, etc. Doing that in real-time during a verbal discussion is unfeasible unless you have a tight integration.
Current API pricing for GPT-4 Turbo is $10 per million input tokens. For a 10k-token session, that’s $0.10 in input costs alone. Output costs $0.30 per million tokens; a thorough analysis might generate 2k tokens, adding $0.60. Total $0.70 per session. That seems cheap. But do this for ten investigations a day, and you are looking at $7/day, $210/month. For a freelancer or small shop, that adds up. More importantly, the latency of processing 10k tokens on a single request can be several seconds—killing the conversational flow.
Moreover, the method implicitly assumes the model can access the most recent on-chain state. But if the model was trained on data up to a certain date, it will not know about last week’s upgrade. The verbal prompt will reconstruct based on outdated knowledge.
Signature: Precision is the only shield against chaos.
4. The Centralization Vector
Karpathy’s method shines with models like Claude (Anthropic) or GPT-4o (OpenAI) that have strong conversational abilities. These are closed-source, centrally controlled. For a blockchain forensic analyst who values decentralization, relying on a black-box AI to interpret on-chain data is ironic. The model’s inference could be biased, censored, or simply wrong—and you have no recourse.
During my 2025 analysis of the Ethereum ETF custody solutions, I discovered that 90% of staked ETH was controlled by three entities. That was a centralization risk. Now consider: if we outsource our investigative reasoning to a single AI provider, we create another centralization risk. The model’s code could be silently patched to ignore certain addresses or downplay certain risks. This is not paranoia; it is the logical outcome of regulatory pressure. The SEC’s regulation-by-enforcement is not ignorance of technology—it is deliberately withholding clear rules. An AI trained to comply with regulation might “forget” to flag that a project is violating securities laws.
I have seen this first-hand. In 2021, during my BAYC audit, I found a race condition in the ownerOf function under high congestion. The metadata indexing was off-chain, but the vulnerability was real. When I reported it, the project’s team asked me to delay publication. If I had used a verbal prompt to “find potential issues in this contract,” the model might have ignored the off-chain indexing flaw because the official documentation said it was fine. The model trusts the whitepaper. I trust the logs.
Contrarian: What the Advocates Got Right
Despite my skepticism, the method has genuine benefits—if applied with caution.
1. Rapid hypothesis generation. In a sideways market, chop is for positioning. The worst thing an investigator can do is waste three days crafting the perfect query for a single hypothesis, only to find the exploit was entirely different. Verbal brainstorming allows you to throw out multiple narratives quickly. The model’s questions can reveal blind spots you didn’t consider.
2. Lower entry barrier for junior analysts. New on-chain detectives often struggle with formulating precise queries. They know something is wrong but lack the vocabulary to ask. Voice chat with an AI can accelerate their learning by showing them how an expert might structure the investigation. The model acts as a tutor, not just a tool.
3. Depth of reasoning through contradiction. When the model asks a stupid question, you are forced to articulate why it is stupid. That sharpens your own understanding. In my Uniswap V2 oracle flaw discovery, I initially thought the vulnerability was limited to low-liquidity pairs. It took a colleague asking “what about the TWAP aggregation?” to make me realize the flaw extended to twelve lending platforms. A model that asks questions—even wrong ones—can trigger that same realization.
But the advocates ignore the fundamental tension: blockchain forensics is about immutable, unforgiving logic. The code does not care about your conversational flow. If the model reconstructs your intent incorrectly, you might miss a critical transaction. Unlike general writing, there is no undo button in the on-chain world.
Takeaway: Accountability in the Age of Verbal AI
Karpathy’s long-form verbal prompt is a glimpse into the future of human-AI collaboration. For blockchain detectives, it offers a way to accelerate the messy, creative part of investigation—the part where we piece together disconnected facts into a coherent theory. But it must not become a crutch that replaces rigor.
Every time I use this method, I force myself to do a final step: take the AI’s structured output and verify each claim against the raw on-chain data. I run the exact queries myself. I check the logs. I trace the transactions.
The silence in the logs speaks louder than noise. If the model’s reconstruction is missing a log that should be there, that silence is a warning.
So I ask you: when your AI partner asks the wrong question, who audits the auditor?