Chainalysis flags $36.7M tied to hidden DeFi code

At least US$36.7 million was lost across four decentralised finance exploits in the past six months as attackers increasingly targeted unverified smart contracts whose source code was not publicly available, according to a new Chainalysis report.

The largest attack involved Truebit, which lost US$26.2 million after a hacker exploited an integer overflow vulnerability in a contract that had remained unverified on Ethereum since 2021.

“Protocols relying on hidden code are increasingly depending on obscurity as a security measure,”

Chainalysis said in its report.

The other incidents involved Trusted Volumes, Aperture Finance and Ekubo, with Chainalysis noting that each exploited contract lacked publicly accessible source code and therefore received less scrutiny from researchers and bug bounty programmes.

According to the blockchain analytics firm, advances in artificial intelligence and smart contract decompilation tools are reducing the effectiveness of keeping code private by allowing attackers to reverse-engineer contracts and identify vulnerabilities more efficiently.

Chainalysis said tasks that previously required skilled reverse engineers working for days on a single contract can now be partially automated across large numbers of unverified contracts, expanding the attack surface for hackers.

The findings come amid a broader increase in crypto security incidents, with DeFiLlama reporting US$629.7 million stolen through crypto exploits in April alone, while Chainalysis recommended source code verification, expanded bug bounty coverage and real-time monitoring tools as key defences against future attacks.

At the time of reporting, Ethereum price was $1,644.54.