The Hidden Code Problem: How Unverified Smart Contracts Are Becoming a Preferred Target for Attackers

Chainalysis analyzes a recent pattern of DeFi exploits targeting unverified (closed-source) smart contracts: attackers decompiled bytecode, identified vulnerabilities (e.g., integer overflow, access-control flaws), and stole roughly $36.7M across several incidents — including a $26.2M Truebit drain. The report argues that modern decompilers combined with AI/LLMs enable automated pipeline-driven discovery and exploitation of unverified contracts, recommends verifying source code, expanding bounty coverage, auditing deployed artifacts, and implementing real-time on-chain monitoring as mitigations.