Crypto Hackers Drain Over $36M From Protocols Using Unverified Contracts
A crypto hacker who drained $26 million from Ethereum-based protocol Truebit in January had likely practiced the technique on smaller targets first, according to blockchain analytics firm Chainalysis.
A Contract Left Exposed For Years
The Truebit exploit was the largest of four incidents Chainalysis identified in a new report covering the past six months. Together, those attacks — targeting Truebit, Trusted Volumes, Aperture Finance, and Ekubo — account for roughly $37 million in losses, all traced back to contracts whose source code had never been publicly verified on blockchain explorers.
The Truebit contract had been sitting on Ethereum since 2021. It was compiled using Solidity v0.5.3, a version released before automatic overflow protections became standard. An attacker found an integer overflow flaw inside its bonding curve mechanism and used it to mint large quantities of tokens at minimal cost before converting them to ETH.
Why Closed Code Creates Open Risk
Verified contracts get reviewed. Bug bounty hunters read them. Independent researchers flag problems before attackers do. Unverified contracts get none of that scrutiny, and many bug bounty programs specifically exclude them from coverage — meaning vulnerabilities can sit untouched for years while millions of dollars flow through the affected code.
Source:
Chainalysis
That gap is what Chainalysis says attackers are now exploiting. Each of the four compromised contracts lacked publicly available source code. Attackers worked instead from decompiled bytecode, converting raw on-chain code into readable output using tools like Dedaub, Heimdall, and Panoramix.
Once decompiled, the code can be fed into AI systems capable of spotting reentrancy flaws, arithmetic errors, and access-control weaknesses at a scale no human reviewer could match.
The $36.7 million figure is a fraction of total DeFi losses during the same period — Chainalysis puts the broader six-month theft total above $1 billion. But the firm argues the unverified contract problem could grow as automated analysis tools become cheaper and easier to use, allowing attackers to scan large numbers of dormant contracts and rank them by exploitability.
The Vulnerabilities Varied, But The Pattern Did Not
Across the four incidents, the specific bugs differed. Reports indicate weaknesses ranged from integer overflow and access-control failures to input-validation errors and identity verification flaws.
What they shared was the same protection gap: no public source code, no external review, and no real-time monitoring in place to catch abnormal activity before the funds were gone.
Chainalysis is recommending that protocols treat source-code verification as a baseline requirement for any contract holding user assets.
The firm also says audits and bug bounty coverage should extend to implementation contracts sitting behind proxy structures — components that often go unreviewed even when the front-facing contract is verified.
Featured image from CybersecAsia, chart from TradingView
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
APT breaks resistance, CRYPTO ME targets $4 if support at $0.75 holds
Multiple Factors Weigh In, Intensifying U.S. Treasury Sell-Off! 5-Year Yield Breaks 5% for the First Time Since 2007, 10-Year Yield Surpasses 5.1%
The stronger-than-expected U.S. September PMI, international crude oil prices returning above $100, and Fed governors signaling possible rate hikes have all negatively impacted the bond market. The disappointing 5-year Treasury auction has further worsened market sentiment. The psychological barrier of a 5% yield on the 10-year U.S. Treasury is losing its significance as a "ceiling," with the market now starting to discuss a potential 6%. In addition to rate hike expectations, fiscal and supply pressures are also driving up long-term bond yields.
According to reports, the Trump administration considered a 90-day diesel export ban, but this was later denied, with the US Secretary of Energy openly opposing it.
On Wednesday, according to Politico, the Trump administration was preparing a 90-day ban on diesel exports. Shortly after, Reuters reported that the United States was not preparing to implement such a ban. On the same day, the U.S. Secretary of Energy stated that banning diesel exports would "definitely not work," as it would force refineries to cut production, thereby driving up gasoline and jet fuel prices. After Politico's report, U.S. diesel futures fell by more than 7% before rebounding slightly, but the losses were not fully recovered.
Glassnode Has Turned Bullish on Bitcoin—They Revealed the Level They’re Waiting For
