- A preprint from security firm ack3 and the Czech Technical University in Prague looked at 135 DeFi incidents from the first half of 2026, with $939.86m of attributed losses.
- Where a public pre-incident audit could be found, 46 of 68 attack paths sat outside every audit scope the researchers could identify.
- Those 46 accounted for 94.4% of losses in that subset, but two incidents dominate the figure. Strip them out and it falls to 72.1%.
“Audited” is the word that does the most reassuring in decentralised finance, and it’s one of the least precise. A new academic dataset tries to measure the gap between what people hear in that word and what an audit actually reviewed, and the answer is wider than most holders would assume.
If you’ve ever checked that a was audited before putting money in, you were doing the sensible thing with the information available. The problem is that the badge describes a piece of work with edges, and the money usually leaves through something on the other side of those edges: a key, a price feed, a bridge, a server. Knowing where the edges are changes what that badge is worth to you.
It also changes how you read the coverage. The headline number in this story is real and it is fragile, and both of those things are true at the same time.
What an audit is, starting from nothing
A DeFi protocol is a set of programs, called , that sit on a and hold and move money without a company in the middle. Because the code is in charge, a mistake in the code is a mistake nobody can reverse once it’s been used.
A security audit is a firm being paid to read that code and look for those mistakes. Reviewers go through it line by line, run tools against it, try to think of ways it could be pushed into behaving badly, and then publish a report listing what they found and what the team fixed.
The part that gets lost is the first page of that report. Every audit begins by defining a scope: the named files, the specific version, sometimes a particular commit in the project’s code history, reviewed on a particular set of dates. It is a snapshot of a defined object at a defined moment, not a verdict on a company.
The things a scope routinely leaves out
Once you know a scope is a list, the obvious question is what isn’t on it. In practice, several categories almost never are.
Administrative keys come first. Most protocols keep the ability to upgrade contracts, pause the system or move funds, usually behind a multisig, a wallet that needs several people to approve a transaction. An audit can confirm those powers exist and are wired correctly. It cannot tell you whether the humans holding the keys are careful, or whether one of their laptops is compromised.
Then there are , the services that tell a protocol what an asset is worth. A lending protocol that doesn’t know the price of the collateral can’t function, so it asks an outside feed. If that feed can be pushed to a wrong number, the code does exactly what it was written to do and hands out money it shouldn’t.
Bridges are a category of their own. Moving a between two chains usually means locking it on one side and having something verify that lock before releasing a matching token on the other. Plenty of that verification happens off-chain, on ordinary servers, which are not smart contracts and are not in scope.
Upgrades come next, and they’re the quietest problem. A contract reviewed in March is not the contract running in September if the team has shipped changes since, unless those changes were reviewed too.
Front ends round it off. The website you interact with is a normal web page on normal hosting with a normal domain name. Hijack the domain or the hosted files and you can serve a page that asks users to sign a transaction that empties their wallets, without touching the audited code at all.
What the researchers actually did
The paper, a preprint on arXiv from Josef Gattermayer and Jan Kalivoda of ack3 with Arman Bašović of the Czech Technical University in Prague, catalogues 135 DeFi incidents between 1 January and 29 June 2026. Of those, 122 are recorded as confirmed and 13 as likely. Total attributed loss: $939.86m. The median incident was far smaller than the headlines suggest, at $413,000, with most falling between roughly $135,000 and $2.6m.
For each incident the authors went looking for evidence of a public audit carried out before the attack. They found one for 68 incidents, just over half. Another 35 had no identified audit, and 32 had an audit history the researchers couldn’t determine.
Within those 68, they compared the route the attacker took against the boundaries of the audits they could find. Forty-six attack paths fell outside every identified scope. Twenty fell inside at least one. Two couldn’t be resolved either way. The out-of-scope group was 67.6% of that subset by count and 94.4% by money lost.
Why that 94.4% needs handling with care
Two incidents carry it. Kelp DAO lost $292m to a forged bridge message after off-chain verifier and RPC infrastructure was compromised, and Drift Protocol lost $285m through compromised multisig authorisation. Remove those two and the out-of-scope share of losses drops from 94.4% to 72.1%. A figure that swings twenty-two points when you take out two data points is telling you something about concentration as much as about auditing.
There are other limits worth stating plainly, because they don’t appear in most coverage of this paper. The 68-incident subset is self-selected: it contains the protocols whose audits were public and findable, which is not a random sample of anything. A scope classified as “identified” reflects what the researchers could locate in public, not necessarily what a protocol’s audit contract actually covered, and an audit that existed but was never published would read here as no audit at all. The loss figures are ack3’s own compilation rather than independently verified accounting. And the paper has not been peer reviewed.
The authors are careful about this themselves. CryptoSlate, reporting the study under the headline “Audited DeFi protocols lost $885M to attacks that occurred completely outside their audit scopes”, notes in its own body text that the percentage is “not an estimate of audit effectiveness or proof that an audit’s boundaries caused a loss”. That $885m figure is CryptoSlate’s arithmetic on the 94.4% share rather than a number we could find stated in the preprint, so treat it as a derived total rather than a finding.
What the study does support is narrower and more useful than the headline: among incidents where an audit existed and could be found, the attack usually came through something the audit had not been asked to look at.
Reading an audit report like someone who knows what to look for
You don’t need to understand the code to get value out of the first two pages, which is where the scope lives.
Check which contracts were reviewed and whether the version matches what’s deployed now. Check the date, and how much has shipped since. Check whether the report says anything about key management, oracles or bridge components, or whether it explicitly excludes them, because reputable firms list their exclusions. Check whether the findings were actually fixed, since a report is allowed to say “acknowledged” and move on. And check whether there’s more than one audit, because two firms looking at different parts is a meaningfully different picture from one firm looking at a fraction.
None of that makes a protocol safe. It tells you how much of it somebody has looked at, which is a different question and the only one an audit can answer.
What to watch
Whether the preprint survives peer review with its classifications intact, and whether the dataset gets extended into the second half of 2026. A single six-month window with two dominant incidents is thin ground for a trend.
Beyond that, watch whether any audit firms start publishing scope summaries in plain language at the top of their reports, the equivalent of a label rather than a document. The paper’s real contribution is showing how much work the word “audited” is being asked to do in public. If you’re weighing up how much of your holdings should sit in this kind of protocol at all, our guide to self-custody covers the trade-offs on the storage side, and there’s more DeFi coverage in the DeFi section.