Unverified smart contracts, which keep their source code hidden from public view, have become a preferred target for attackers, with at least $36.7 million stolen across five protocols in the past six months. Unlike most major decentralized finance (DeFi) protocols that publish their code on block explorers like Etherscan for transparency and security review, some projects keep their code closed-source. This approach was once thought to provide security through obscurity, but attackers are now systematically reverse-engineering these hidden contracts using AI-assisted tools to find and exploit vulnerabilities at scale.

Why Are Unverified Contracts Such Attractive Targets?

The shift toward attacking unverified contracts reveals a fundamental change in how cybercriminals operate in crypto. While it might seem counterintuitive that attackers would target contracts that require decompilation and reverse-engineering, several factors make these hidden contracts more vulnerable than their publicly verified counterparts.

Modern decompilers like Dedaub, Heimdall, and Panoramix can now convert compiled bytecode back into readable code with reasonable accuracy. But the real game-changer is what happens next: large language models (LLMs) can analyze this decompiled code to identify vulnerability patterns automatically. Researchers have demonstrated that LLMs can spot reentrancy flaws, access control gaps, and arithmetic errors in decompiled output with meaningful accuracy. When chained into automated pipelines, these tools can scan thousands of unverified contracts systematically, triaging targets by exploitability and potential yield. What once required a skilled reverse engineer spending days on a single contract can now be partially automated across an entire blockchain's unverified contract inventory.

Beyond the technical advantage, unverified contracts lack the informal but powerful security layer that verified contracts enjoy. When a protocol publishes its source code, thousands of white hat researchers, competitive audit participants, and other developers may review it as part of their normal activity. A vulnerability in a verified contract might be spotted by any of these researchers; the same vulnerability in unverified bytecode is invisible to everyone except the deployer and anyone willing to decompile it. Additionally, several exploited protocols in the dataset had active bug bounty programs, but the unverified contracts were explicitly out of scope, removing another layer of defensive scrutiny.

What Real-World Exploits Reveal About This Attack Pattern?

The data tells a striking story. Between January and May 2026, attackers targeted five protocols with unverified smart contracts, stealing a combined $36.7 million. The largest single exploit involved Truebit, a tokenized asset protocol, where an attacker drained $26.2 million on January 8, 2026.

The Truebit contract had been sitting on Ethereum since 2021 with its implementation never verified on Etherscan. The protocol used a bonding curve mechanism where users could mint TRU tokens with ETH and burn them for ETH at a buyback rate. The vulnerability was an integer overflow in the getPurchasePrice() function. When called with extremely large input values, an unguarded addition operation wrapped around to near-zero, allowing the attacker to mint hundreds of millions of tokens for essentially nothing, then burn them for real ETH.

What makes this case especially striking is evidence of systematic hunting. On-chain analysis revealed that the same address had drained the Sparkle protocol for 5 ETH just twelve days earlier. This was not an opportunistic find; the exploiter was methodically searching for vulnerabilities across verified and unverified contracts, escalating from small targets to a $26 million payday. The proceeds of both exploits were laundered through Tornado Cash, a privacy mixer.

Other notable exploits in the six-month period included Trusted Volumes ($5.9 million stolen on May 7, 2026, via an access control flaw in an RFQ swap proxy), Aperture Finance ($3.2 million on January 25, 2026, through an input validation bypass), and two additional protocols totaling $1.4 million.

How Can Protocols Protect Themselves From These Attacks?

• Verify all smart contracts: Source code verification on block explorers should be treated as a minimum security requirement for any contract that holds or manages user funds. This includes implementation contracts behind proxies, as several of the exploits in the dataset targeted unverified implementations hidden behind verified proxy shells.
• Audit production deployments: Security reviews should cover the actual production deployment, including any contracts added between audit cycles, not just the code that was planned for deployment.
• Extend bug bounty scope: If a contract holds user funds, it should be in scope for the bug bounty program regardless of whether it is on the main chain, a legacy product, or a recently added feature.
• Implement real-time monitoring: For protocols deploying unverified contracts, whether intentionally or due to operational gaps, on-chain monitoring becomes the critical last line of defense. Tools like Chainalysis Hexagate can detect anomalous transaction patterns, flag suspicious function calls, and trigger automated responses even when the underlying source code is not publicly available.

The emergence of AI-assisted exploit development is likely accelerating this trend. As LLMs become more sophisticated at identifying vulnerability patterns in decompiled bytecode, the barrier to entry for attackers continues to fall. Meanwhile, the traditional security ecosystem, which relies on white hat researchers, competitive audits, and public code review, cannot function without readable source code. This asymmetry creates a structural advantage for attackers targeting unverified contracts.

The $36.7 million stolen from unverified contracts in six months represents a fraction of the more than $1 billion that DeFiLlama records being stolen from 88 protocols overall, most of them with verified smart contracts. However, especially in an era where smart contracts can be easily decompiled and analyzed by AI, attacks against unverified contracts are likely to continue and potentially accelerate. The crypto security community must adapt its defensive strategies to account for this emerging attack pattern, treating code verification and real-time monitoring as non-negotiable requirements rather than optional security enhancements.