Hackers Exploit Unverified Smart Contracts, Draining Millions
A cryptocurrency hacker who siphoned $26 million from the Ethereum-based protocol Truebit in January likely honed their technique on smaller targets beforehand, according to blockchain analytics firm Chainalysis.
A Contract Left Exposed for Years
The Truebit exploit was the most significant of four incidents identified by Chainalysis in a new report covering the past six months. Collectively, these attacks—targeting Truebit, Trusted Volumes, Aperture Finance, and Ekubo—resulted in approximately $37 million in losses. All of these incidents were traced back to smart contracts whose source code had never been publicly verified on blockchain explorers.
The Truebit contract had been deployed on Ethereum since 2021. It was compiled using Solidity v0.5.3, a version released before automatic overflow protections became standard. An attacker exploited an integer overflow flaw within its bonding curve mechanism, enabling them to mint large quantities of tokens at minimal cost before converting them to ETH.
Why Closed Code Creates Open Risk
Verified contracts undergo scrutiny. Bug bounty hunters examine them, and independent researchers flag potential issues before attackers can. Unverified contracts, however, lack this oversight. Many bug bounty programs specifically exclude them from coverage, meaning vulnerabilities can persist for years while significant funds flow through the affected code.
Chainalysis suggests that attackers are now capitalizing on this gap. Each of the four compromised contracts lacked publicly available source code. Instead, attackers worked with decompiled bytecode, converting raw on-chain code into a readable format using tools such as Dedaub, Heimdall, and Panoramix. Once decompiled, the code can be processed by AI systems capable of identifying reentrancy flaws, arithmetic errors, and access-control weaknesses at a scale far beyond human capacity.
While the $36.7 million figure represents a fraction of the total DeFi losses during the same period—Chainalysis estimates broader six-month theft totals exceeding $1 billion—the firm argues that the unverified contract problem could escalate. This is due to the increasing affordability and ease of use of automated analysis tools, which allow attackers to scan numerous dormant contracts and prioritize them by exploitability.
The Vulnerabilities Varied, But the Pattern Did Not
The specific vulnerabilities differed across the four incidents, with reported weaknesses ranging from integer overflow and access-control failures to input-validation errors and identity verification flaws.
What these incidents shared was a common security gap: the absence of public source code, external review, and real-time monitoring to detect abnormal activity before funds were drained.
Chainalysis recommends that protocols establish source-code verification as a fundamental requirement for any contract holding user assets. The firm also advises that audits and bug bounty coverage should extend to implementation contracts situated behind proxy structures—components that often remain unreviewed even when the front-facing contract is verified.
Leave a Reply