AI-Assisted Hackers Steal $36.7M from Unverified DeFi Smart Contracts in First Half of 2026

Jun 9, 2026

A Chainalysis report reveals that AI-assisted hackers stole $36.7 million from DeFi protocols in the first half of 2026 by exploiting unverified smart contracts. The attackers used advanced decompilation tools to find vulnerabilities in closed-source code. The largest incident was a $26.2 million exploit of Truebit. Chainalysis urges protocols to adopt source code verification as a minimum security standard.

Unverified smart contract exploits

▪Attackers stole approximately $36.7 million from DeFi protocols by exploiting unverified smart contracts between January and May 2026.
▪The $36.7 million in losses represents a fraction of the more than $1 billion stolen from all DeFi protocols during the same six-month period.
▪The exploited contracts had not been verified on a blockchain explorer, meaning their source code was not publicly available for review.

AI-powered decompilation tools

▪Attackers can use large language models to analyze reverse-engineered code and identify common vulnerabilities.
▪Advances in AI and smart contract decompilation tools are making it easier for attackers to reverse-engineer closed-source code.

Major DeFi protocol attacks

▪Other major incidents included a $5.9 million theft from Trusted Volumes, a $3.2 million loss from Aperture Finance, and a $1.4 million loss from Ekubo.
▪The largest attack targeted Truebit on January 8, 2026, resulting in losses of about $26.2 million.

Security vulnerabilities in closed-source contracts

▪The Truebit exploit was caused by an integer overflow vulnerability in a contract that had been unverified since 2021.
▪Unverified contracts receive less scrutiny from security researchers and are often excluded from bug bounty programs, reducing the chance of discovery.
▪Evidence suggests the Truebit attacker systematically hunted for vulnerable contracts before executing the exploit.

Smart contract verification recommendations

▪Blockchain analytics firm Chainalysis published a report on the trend, challenging the idea that hiding source code improves security.
▪Further recommendations from Chainalysis include auditing deployed code and implementing real-time monitoring for suspicious on-chain activity.
▪Chainalysis recommends that protocols treat source code verification as a minimum security standard and expand bug bounty coverage.