Attackers Target Unverified Smart Contracts, Stealing $36.7 Million

In the past six months, attackers have exploited unverified smart contracts, stealing at least $36.7 million from various protocols, including Truebit and Trusted Volumes. The attacks involved decompiling the raw bytecode of these contracts, which lack community scrutiny and are often excluded from bug bounty programs. The Chainalysis report highlights that the barrier for AI-assisted exploit development is lowering, allowing attackers to systematically scan thousands of unverified contracts. A significant incident occurred on January 8, 2026, when an attacker drained $26.2 million from Truebit by exploiting an integer overflow vulnerability in its contract. This trend is likely to continue as the security of unverified contracts remains a concern.

Key Points: • Attackers stole $36.7 million from unverified smart contracts in six months. • AI tools are facilitating the identification of vulnerabilities in these contracts. • Protocols are urged to verify contracts and expand bug bounty programs to enhance security.