DeFi Audits Fall Short: Study Reveals 94.4% of Losses Come from Outside Audit Scopes

A new study sheds light on the limitations of DeFi protocol audits, which often provide only partial assurance of security. Researchers affiliated with ack3 and the Czech Technical University in Prague examined 135 reported incidents from the first half of 2026, with $939.86 million in attributed losses.

They found that 46 attack paths were outside every audit scope they could identify, representing 67.6% of incidents but 94.4% of their reported losses. The two largest cases, Kelp DAO and Drift Protocol, accounted for most of the losses.

The study highlights a basic assurance problem in DeFi: while projects may truthfully claim to have been audited, users may still be unable to determine whether the live system, path holding their funds, or controls around it were reviewed.