Attackers have stolen at least $36.7 million from crypto protocols with unverified smart contracts over the past six months. Chainalysis attributes this spike directly to AI-assisted exploit development.
Large language models now analyze decompiled bytecode faster and at greater scale than any human security team. This structural advantage has neutralized a defense mechanism that once worked: obscurity through closed-source code. Attackers previously faced friction when trying to reverse-engineer unverified contracts. That friction has evaporated.
The threat operates at multiple layers. First, LLMs can decompose smart contract bytecode into readable pseudocode. Second, they identify logical flaws and reentrancy vulnerabilities automatically. Third, they generate working exploit code without human intervention. The entire pipeline runs on commodity infrastructure.
Chainalysis flagged this as a turning point in the asymmetry between attackers and defenders. Traditional audits happen once, static, and cost tens of thousands of dollars. AI-powered scanning happens continuously across thousands of targets. An attacker can now test exploit feasibility across dozens of protocols in hours.
The $36.7 million figure represents only detected theft from unverified contracts. Real losses likely run higher, as many smaller exploits go unreported or remain unanalyzed. The cohort targeted includes yield farming protocols, wrapped token bridges, and governance contracts where the source code remains proprietary or obfuscated.
Defenders face a dilemma. Full contract verification on-chain eliminates ambiguity but sacrifices trade secrets and competitive advantage. Many protocols skip verification specifically to keep exploit research harder. That calculation has inverted. Verified contracts now face better-audited competition and faster patching cycles. Unverified contracts face AI-accelerated attackers with no speed advantage.
The report signals a shift in crypto security from perimeter defense to continuous resilience. Protocols must now assume an LLM attacker has already reverse-engineered their bytecode within hours of deployment. Exploit-in-waiting scenarios become baseline threat models, not edge cases.
Chainalysis did not name specific protocols or attacks. The firm implied the trend will accelerate as LLM capabilities improve and attack surface expands across rollups and sidechain deployments. Developers who delay or skip formal verification now operate with exponentially higher execution risk.