More than $36 million in losses have been linked to attacks on unverified DeFi smart contracts over recent months, according to a Chainalysis report. These contracts, which lack publicly available source code, have become a prime target for hackers who leverage advanced tools to uncover and exploit hidden vulnerabilities.
The largest single exploit involved Truebit, which lost over $26 million through an integer overflow vulnerability in an Ethereum smart contract unverified since 2021. Other projects targeted include Trusted Volumes, Aperture Finance, and Ekubo, all of which similarly operated with unverified contracts that escaped public scrutiny and much of the bug bounty landscape.
Chainalysis links this surge in attacks to improvements in decompilation software and artificial intelligence, which allow malicious actors to reverse-engineer bytecode more efficiently. What traditionally required days of expert manual analysis can now be partially automated, enabling attackers to systematically probe numerous hidden contracts. This development undermines a longstanding belief in the DeFi community that obscuring source code adds a meaningful security layer.
The report warns that relying on code obscurity as a defense is increasingly ineffective. It urges protocols to adopt source code verification, expand bug bounty program coverage, and implement real-time monitoring tools to detect suspicious activity promptly. These measures aim to increase transparency and resilience against future exploits.
This trend emerges amid a broader spike in crypto thefts. April recorded nearly $630 million stolen across DeFi platforms, driven largely by two major hacks at KelpDAO and Drift Protocol, accounting for the majority of losses. Though exploit volumes declined sharply in May, with around $68 million reported stolen, repercussions from the April breaches continued. For instance, blockchain intelligence firm Arkham revealed that the KelpDAO attacker laundered nearly all their unfrozen loot, estimated at $220 million.
Following these incidents, multiple DeFi protocols reassessed their security frameworks. Projects like Solv Protocol announced plans to transition to more robust infrastructures, such as Chainlink's cross-chain platform, aiming to mitigate risks highlighted by recent attacks.