Panewslab Attackers Target Unverified Smart Contracts, Stealing $36.7 Million
Article Content
- •Attackers stole $36.7 million from unverified smart contracts in six months.
- •AI tools are facilitating the identification of vulnerabilities in these contracts.
- •Protocols are urged to verify contracts and expand bug bounty programs to enhance security.
In the past six months, attackers have exploited unverified smart contracts, stealing at least $36.7 million from various protocols, including Truebit and Trusted Volumes. The attacks involved decompiling the raw bytecode of these contracts, which lack community scrutiny and are often excluded from bug bounty programs. The Chainalysis report highlights that the barrier for AI-assisted exploit development is lowering, allowing attackers to systematically scan thousands of unverified contracts. A significant incident occurred on January 8, 2026, when an attacker drained $26.2 million from Truebit by exploiting an integer overflow vulnerability in its contract. This trend is likely to continue as the security of unverified contracts remains a concern.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Truebit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…