Audit Gap Exposes Flaws in Crypto Security

Crypto theft is a complex issue that can't be solved by simply auditing smart contracts. In fact, an audit gap exists between what auditors find and where the actual losses occur.

A recent study found that while 37.6% of published audit findings focused on logic and business-logic defects, code quality issues, and input validation flaws, these problems only accounted for 43.9% of stolen value.

Private-key theft and phishing attacks, which are largely outside conventional contract review, made up 49.6% of losses, with private-key compromise alone responsible for $1.894 billion in losses.

The study also found that attackers often go around the code itself, targeting people, dependencies, or governance instead.