According to reports from Chainalysis, attackers stole at least $36.7 million from protocols running unverified smart contracts over the past six months. The firm attributes this surge to AI-assisted exploit development, where large language models (LLMs) can now analyze decompiled bytecode at a speed and scale no human team can match. As reported by Chainalysis, closed-source contracts that once deterred attackers have become systematic targets as decompilers such as Dedaub, Heimdall, and Panoramix now convert raw bytecode into readable Solidity. The rise of AI-assisted exploitation is moving from theoretical concern to documented reality, with researchers demonstrating that LLMs can identify reentrancy flaws, access control gaps, and arithmetic errors in decompiled output with meaningful accuracy.
Once decompiled, the code feeds directly into LLMs that flag reentrancy bugs, access control gaps, and arithmetic errors. According to Chainalysis, these models can scan thousands of unverified contracts and triage targets by estimated exploitability and potential yield. The report states that what once required a skilled reverse engineer spending days on a single contract can now be partially automated across an entire blockchain's unverified contract inventory. Attackers operating these pipelines gain a structural advantage as they can cover far more ground than defenders monitoring for suspicious activity. The convergence of three factors — a growing inventory of unverified contracts on public blockchains, increasingly capable decompilation tools, and AI models that can analyze bytecode at scale — suggests this trend will accelerate.
The largest incident occurred on January 8, when an attacker drained $26.2 million from Truebit. As reported by Chainalysis, the vulnerable contract had sat unverified on Ethereum since 2021, with an integer overflow in its bonding curve allowing the attacker to mint tokens for almost nothing and burn them for real ETH. Notably, the same address had drained the Sparkle protocol for 5 ETH just twelve days earlier. The contract used a bonding curve mechanism where users could mint TRU tokens with ETH and burn them for ETH at a buyback rate. The vulnerability was an integer overflow in the getPurchasePrice() function when called with extremely large input values, with the contract compiled with Solidity v0.5.3, which predates automatic overflow checks. The exploiter was methodically searching for vulnerabilities across verified and unverified contracts, escalating from small targets to a $26 million payday, and the proceeds of both exploits were laundered through Tornado Cash.
According to Chainalysis, unverified contracts also escape the informal security layer protecting open-source code, as white-hat researchers cannot read them. Several protocols that were exploited excluded these contracts from their bug bounty programs, with the analysis focusing solely on protocol-owned or protocol-deployed contracts responsible for holding, managing, or controlling user funds. The firm notes that Anthropic research demonstrated that AI agents can autonomously exploit smart contracts for millions of dollars, including contracts deployed after the models' knowledge cutoff. Security experts have already warned that AI agents are outpacing human auditors across DeFi, with the smart contract threat not existing in isolation as automated tooling enables coordinated software supply chain attacks at scale on platforms like GitHub.
As reported by Chainalysis, the firm expects the trend to accelerate as decompilation tools improve and the pool of unverified contracts grows. The firm urges protocols to verify all deployed code, extend bug bounty scope, and adopt real-time on-chain monitoring. The report emphasizes that protocols should not rely on obscurity for security, as closed-source contracts no longer provide protection against systematic AI-powered vulnerability hunting. Real-time on-chain monitoring is especially critical for protocols deploying unverified contracts, since the traditional security ecosystem cannot function without readable source code. The crypto security community has long debated whether open-sourcing smart contract code makes protocols safer, but the overwhelming majority of major DeFi protocols publish their source code and verify them on Etherscan, while some protocols keep their code closed-source, denying would-be attackers and security researchers an easy chance to analyze their code.
