A preprint study from researchers affiliated with security firm ack3 and the Czech Technical University in Prague found that audited DeFi protocols lost the overwhelming majority of their funds to attacks that fell completely outside every audit scope the researchers could identify.
The paper examined 135 DeFi incidents reported in the first half of 2026, with $939.86 million in attributed losses. Of those, 68 incidents involved protocols with identifiable public audits. Within that subset, the authors classified 46 attack paths as outside every audit scope they could find, 20 as inside at least one scope, and two as unresolved. The outside-scope group accounted for $680.97 million of $721.24 million in losses, or 94.4%.
Two outliers skew the headline
The 94.4% figure comes with serious caveats. Two cases dominate the sample: $292 million lost at Kelp DAO and $285 million at Drift Protocol. Excluding those two, the outside-scope share drops to 72.1% of losses in the same audited subset. That is still a striking number, but it is a different number, and anyone citing the study should quote both.
The outside-scope group represented 67.6% of the audited incidents but 94.4% of their reported losses, which tells you the biggest exploits were almost never the ones aimed at reviewed code. The study also has a structural limit: it has no unexploited comparison group. It cannot show whether audited protocols are safer than unaudited ones, only how losses distributed within a selected set of reported incidents. CryptoSlate’s analysis of the paper stresses that the percentage describes the distribution of losses, not an estimate of audit effectiveness or proof that audit boundaries caused the losses.
There is also a selection problem baked into any incident dataset. Incidents that get reported and quantified skew toward larger protocols with more assets at risk, and larger protocols are more likely to have public audits in the first place. That makes the audited subset the natural home for the biggest losses regardless of how good audits are. The authors do not claim to have solved this; they simply document it.
What audits actually cover
The core finding is duller than the headline but more useful: audit history and audit scope are different variables. A reviewed smart contract does not automatically confer the same assurance on an upgrade, a privileged key, a front end, a relayer, an oracle, a cloud service or an incident-response process. An audit covers named code at a point in time, not the live system around it.
Attackers have noticed. The most expensive exploits of 2026 have largely not been novel contract bugs but operations against the seams: bridged message verification, upgradeable proxy patterns, off-chain signing schemes and third-party dependencies that nobody’s audit report mentions. A protocol can carry three audit reports and still have its critical risk sitting in an unreviewed upgrade path or an admin key held by a multisig whose signers nobody checked. Each new integration adds another seam, and each seam multiplies the surface that no report covers.
August’s two case studies
Two incidents from August illustrate the gap in different ways. In ICON Network’s replay exploit, an audited migration contract and a signature scheme disagreed on what made a withdrawal message unique. An attacker resubmitted the same signed message 1,490 times, collecting payouts each time. ICON said net losses were about 150.2 ETH plus 31,204 USDC, with most assets recovered. The code was reviewed; the boundary between two systems was not. The attack succeeded precisely where two verified components met and each made an assumption the other did not share.
The aelf incident is the contrast case. In August, unauthorized contracts delivered encoded .NET assemblies into node execution on the aelf network. The compromise ran through the runtime and operational layer, and researchers have not been able to tie it to any specific pre-incident audit at all. There was no scope for the attack to fall outside, because nothing in the audit process touched that layer. Both cases point to the same lesson from opposite directions: the review that matters is the one that covers the layer the attacker actually used.
Implications for investors and insurers
For anyone allocating to DeFi, the practical takeaway is to read the audit scope, not just the audit badge. The study suggests asking which components were in scope, when the review happened, and what has changed in the contract system since. A protocol that shipped three upgrades after its last audit is effectively unaudited on its current code.
For insurers and coverage providers, the finding complicates underwriting. Policies priced on “protocol is audited” may be insuring the wrong thing. The outside-scope share suggests premium models should weight operational controls, key management and monitoring at least as heavily as audit history. Incident response also matters more than the sample suggests: in the ICON case most funds were recovered because the team caught the replay loop quickly, which is a monitoring outcome, not an audit outcome.
The authors acknowledge the preprint has limits and say they hope the dataset will grow through the second half of the year. Even in its current form, it puts a number on something security engineers have said for years: the audit badge answers a question, just rarely the one the exploit ends up asking. Until coverage models and investor checklists catch up with that gap, the most useful line in any audit report may be the one listing what it did not look at.