Blockchain analytics firm Chainalysis has identified at least $36.7 million in losses across four decentralized finance exploits since January 2026, all targeting protocols whose smart contracts had not been verified on a blockchain explorer. The findings, published on June 8, challenge a foundational assumption in DeFi security: that keeping source code private provides meaningful protection against attackers.

According to Chainalysis, the four affected protocols each held significant user funds in contracts whose source code was not publicly available for review. That limited external scrutiny from security researchers and excluded the contracts from most established bug bounty programs, even as they remained accessible to increasingly sophisticated attackers.

Truebit Incident Accounts for the Majority of Losses

The largest of the four incidents involved Truebit, a decentralized computation protocol, which lost $26.2 million after an attacker successfully exploited an integer overflow vulnerability. The compromised contract had been deployed on Ethereum in 2021 without verification and had remained publicly unreadable for nearly five years before the exploit occurred.

The remaining three incidents involved Trusted Volumes, Aperture Finance, and Ekubo. Together, those three protocols accounted for approximately $10.5 million of the total losses. In each case, attackers demonstrated the ability to identify and exploit vulnerabilities in contracts without access to the original source code.

Decompilation Tools Erode Code Obscurity as a Defense

Chainalysis attributed the growing effectiveness of these attacks to advances in decompilation tools and automation technology, which allow attackers to reverse-engineer smart contract bytecode and identify exploitable flaws even when source code is not publicly available. The firm noted that what once required a skilled specialist spending days analyzing a single contract can now be partially automated across large batches of unverified protocols.

The report describes the reliance on hidden code as "obscurity as a security measure," a posture that Chainalysis said is rapidly losing effectiveness. Protocols that withhold source code on the assumption that attackers cannot read contract logic are exposed to a growing pool of adversaries equipped with tooling that substantially reduces that barrier.

Recommendations and Broader Market Context

Chainalysis recommended three primary safeguards for DeFi protocols: source code verification on blockchain explorers, broader participation in bug bounty programs, and implementation of real-time on-chain monitoring tools. The firm argued that verification, in particular, opens contracts to community-level scrutiny that provides a far stronger security baseline than concealment.

The report arrives against the backdrop of a sharp rise in total crypto losses during 2026. According to DeFiLlama, hackers stole $629.7 million in April alone, the highest monthly figure since February 2025. While losses declined in May to approximately $68.3 million per CertiK's estimates, the lingering effects of the April attacks continued into June.

The KelpDAO exploit from April, which resulted in $293 million in stolen funds, saw its attacker launder nearly all of approximately $220 million in unfrozen assets by June, according to blockchain intelligence platform Arkham. The episode prompted several DeFi protocols to begin reviewing their security infrastructure and oracle providers.

• Total losses from unverified DeFi contracts since January 2026: $36.7 million

• Truebit loss: $26.2 million (integer overflow exploit, contract unverified since 2021)

• Other affected protocols: Trusted Volumes, Aperture Finance, Ekubo

• Total crypto hacks in April 2026: $629.7 million (highest since February 2025)