Unverified smart contracts have been linked to at least $36.7 million in financial losses across four separate decentralized finance exploits over the past six months, according to a recent report from blockchain intelligence firm Chainalysis. The findings highlight a shifting tactic among malicious actors, who are increasingly targeting protocols whose source code is not publicly available on blockchain explorers.
The largest of these recorded incidents involved Truebit, which suffered a staggering $26.2 million loss after an attacker successfully exploited an integer overflow vulnerability. The vulnerability resided within a smart contract that had remained unverified on the Ethereum network since 2021. According to the Chainalysis report, the remaining three incidents involved Trusted Volumes, Aperture Finance, and Ekubo, each falling victim to similar oversights regarding code transparency.
In every single one of these cases, the exploited contract had never been verified on a blockchain explorer. This lack of verification meant that the source code was entirely hidden from public view, shielding it from standard peer review and security analysis. Furthermore, because the code was not publicly visible, these smart contracts were largely excluded from public bug bounty programs, despite controlling significant amounts of user funds.
Chainalysis attributed this emerging trend partly to rapid advancements in decompilation software and artificial intelligence tools. These technologies are increasingly being leveraged by attackers to reverse-engineer smart contract bytecode and pinpoint vulnerabilities even when the underlying source code is kept hidden. According to the report, tasks that previously demanded a skilled reverse engineer to spend days meticulously examining a single contract can now be partially automated across vast numbers of unverified contracts.
The findings pose a direct challenge to a longstanding and deeply ingrained assumption within the decentralized finance ecosystem: that keeping smart contract source code private provides an intrinsic, additional layer of security. Chainalysis warns that protocols relying on hidden code are increasingly depending on what it describes as "obscurity as a security measure"—an approach that the firm emphasizes is rapidly losing its effectiveness in the face of modern automated attack vectors.
To combat these evolving threats, Chainalysis recommended that protocols prioritize source code verification, expand bug bounty coverage to encompass a wider array of codebases, and implement real-time monitoring tools designed to catch unauthorized or anomalous behavior before significant funds can be drained.
DeFi Security Concerns Persist After Record April Losses
The warning regarding unverified contracts comes against the backdrop of a broader, more alarming surge in cryptocurrency exploits across the wider ecosystem. According to data tracked by DeFiLlama, malicious hackers managed to steal an astonishing $629.7 million in the month of April alone, marking the highest monthly total recorded for the sector since February 2025.
The vast majority of April’s devastating losses were driven by just two massive incidents. KelpDAO suffered a catastrophic $293 million exploit, while Drift Protocol was hit by a $280 million attack. Combined, these two events accounted for more than 80 percent of all stolen funds during that single month, putting immense strain on user confidence and protocol developers alike.
Although overall financial losses fell sharply in May, with blockchain security firm CertiK reporting approximately $68.3 million stolen from cryptocurrency exploits during that month, the long-term fallout from April’s high-profile attacks continued to reverberate throughout the industry. In June, blockchain analytics platform Arkham reported that the perpetrator behind the KelpDAO exploit had successfully laundered nearly all of the roughly $220 million in unfrozen stolen funds that remained in their possession.
The KelpDAO exploit had immediate cascading effects, prompting a wave of introspection across the decentralized finance landscape. Several protocols began actively reviewing their underlying security infrastructure and risk management systems. Among them, projects like Solv Protocol announced formal plans to migrate their operations to Chainlink’s crosschain infrastructure following comprehensive internal security evaluations.
The intersection of advanced technology and malicious activity has also drawn scrutiny from other sectors of the tech industry. Earlier this month, AI developer Anthropic reported that out of 832 accounts it banned for policy violations over a one-year period, 560 had utilized artificial intelligence tools to assist in preparing cyberattacks. These activities included writing customized malware and actively identifying software vulnerabilities to exploit.
