Audits No Longer Guarantee Safety in Web3

The first six months of 2026 saw the crypto industry suffer $939.86 million in losses across 135 verified security incidents. While initial reports suggested that unvetted code and protocol vulnerabilities were to blame, a closer look reveals a more complex picture.

Ack3's comprehensive H1 2026 security report found that over half of exploited projects, accounting for $721.24 million in losses, had undergone a completed security audit. However, the attack path in these cases often ran through unreviewed infrastructure and operational breaches, rather than the audited smart contracts themselves.

The 'scope gap' between what is audited and what is not is particularly concerning. In 46 out of 68 audited protocols breached, the exploit path was entirely outside the scope of their published audits, resulting in $680.97 million in losses.