Chainalysis: AI Driving Systematic Exploitation of Unverified Contract Vulnerabilities by Attackers, Resulting in Over $36.7 Million in Losses in the Past Six Months

On June 10, blockchain analytics firm Chainalysis released a report noting that attackers are increasingly targeting smart contracts with unverified source code. Over the past six months, at least four decentralized finance (DeFi) protocols relying on unverified contracts have been hit by attacks, leading to total losses of roughly $36.7 million. The report points out that thanks to advancements in tools like Dedaub and Panoramix for decompiling, plus AI large models capable of rapidly parsing decompiled bytecode, attackers can now bulk scan on-chain unverified contracts, automatically flag vulnerabilities including reentrancy attacks, permission control flaws, and arithmetic overflows, then select the most high-value targets to exploit. Chainalysis explained that while unverified contracts lower barriers for third-party source code reviews, they also miss out on critical security safeguards from white-hat researchers, community audits, and bug bounty programs. A key example is the Truebit hack in January, where an attacker exploited an integer overflow flaw in a contract deployed in 2021 with unverified source code, siphoning around $26.2 million. As AI-assisted vulnerability discovery capabilities continue to improve, the model of relying on code obfuscation for security is quickly becoming obsolete. Chainalysis recommends that DeFi protocol teams treat source code verification as a baseline security standard, strengthen real-time on-chain monitoring, and expand bug bounty coverage to mitigate potential attack risks.