I couldnt find it in the article, how do they "assume" how many victims will fall to these contract exploits?

And to go further: if it costs $3500 in ai tokens, to fix a bug that could steal $3600, who should pay for that? Whos responsibility is it for "dumbass suckers who use other peoples buggy or purposefully malicious money based code" ?

At best this is another weird ad by anthropic, trying to say, hey why arent you changing the world with our stuff, pay up quick hurry

Contracts themselves can hold funds. Usually a contract hack extracts the money it holds.

$3500 was the average cost per exploit they found. The cost to scan a contract averaged to $1.22. That cost should be paid by each contract's developers. Often they pay much more than that for security audits.