Summary
In the last six months, at least $36.7 million has been stolen from protocols whose source code was never publicly verified — meaning attackers had to decompile raw bytecode to find the vulnerabilities.
The rise of AI-assisted exploit development is likely accelerating this trend, as large language models (LLMs) can now identify vulnerability patterns at scale.
This is emerging as a distinct attack pattern. Although unverified contracts receive less public scrutiny, fewer community-driven bug reports, and are excluded from most bug bounty programs, they still hold millions in user funds.
Real-time on-chain monitoring is especially critical for protocols deploying unverified contracts, since the traditional security ecosystem — white hat researchers, competitive audits, public code review — cannot function without readable source code.
