Here's the number that should stop you cold in the middle of this bull run: across 135 DeFi exploits in the first half of 2026, the attacks that landed outside a protocol's audit scope accounted for 94.4% of the $939.86 million in attributed losses.
Not the unaudited projects. The audited ones. The ones with the badge on the website, the ones a venture partner cites in a thread, the ones you assumed were checked. Another rug? No, just a liquidity trap — except this time the trap wasn't hidden in the tokenomics or the vesting cliff. It sat in the empty space between what an audit actually verifies and what actually runs on mainnet.
That gap now has a price tag, and it's approaching ten figures at the halfway mark of the year.
A preprint you should read before your next deposit
The study comes from security firm ack3 and Czech Technical University, released as a six-page preprint with a companion dataset and a machine-readable ledger so the classification counts can be reproduced. It isn't peer-reviewed yet, and the authors say so plainly. They also say something security marketing almost never admits: the 94.4% figure "is not an estimate of audit effectiveness."
That honesty matters, because the framing is explosive regardless.
The methodology is almost brutally simple. Take 135 incidents from January 1 to June 29, 2026. Split them on two axes: was there a prior audit, and did the attack path fall inside that audit's stated scope? What falls out is the observation that a protocol-level security badge describes a moment — specific code, specific components, specific version — while the attack surface keeps moving long after the PDF is signed. Upgrades, privileged keys, relays, oracles, front ends, cloud infrastructure, and incident-response runbooks all tend to sit outside the boundary.
I spent 400 hours back in 2017 mapping gas flows across 50-plus ICOs and learned the same lesson in a different costume: the paperwork and the live system are two separate objects. Audits measure the paperwork.
The ICON replay: when two ends of a bridge disagree on "unique"
The cleanest technical evidence in the report is the ICON/SODAX case, and it's worth slowing down for.
The migration contract used the high bits of a withdrawal message sequence number to decide whether a message was unique. The cryptographic signature, meanwhile, covered only the low 256 bits. That leaves the high bits in an unsigned zone — a region an attacker can rewrite freely while the signature still validates. Flip the high bits, satisfy the uniqueness check, and replay the withdrawal.
The attacker tried 1,492 times. It worked 1,490 times.
This is a textbook signature domain-separation failure layered on top of missing input validation — a low-level defect, not an architectural one. And here's the part that should genuinely bother you. SODAX's audit archive contained eight separate cross-component reports, including a relay audit dated November 2025. Nobody signed off on the interfaces between components. Each auditor checked their own slice. No one verified that the two ends of the bridge agreed on what the word "unique" even meant.
When I reverse-engineered Curve and Uniswap V2 pool mechanics during the 2020 DeFi Summer, the arbitrage I documented came from exactly this kind of asymmetry — two systems holding subtly different beliefs about the same state. Liquidity doesn't care about your audit badge. Neither does a replay bug.
The economics are equally telling. The exploit momentarily released 119.866 million ICX and 531,600 bnUSD, yet the net loss landed near 150.2 ETH plus 31,204 USDC, with 531,600 bnUSD and 1.366 million SODA clawed back. A gap that wide between nominal release and realized damage tells you two things: the chain-level tracer worked, and some of those assets carried a freeze switch. That kind of issuer-level intervention is the quiet counterweight to every "fully decentralized" claim on a pitch deck.
Then the 90 minutes that made it worse
Detection wasn't the failure. Containment was.
The first automated alert fired at 02:08 UTC, roughly seven minutes after the attack began. Full incident response took about ninety minutes. Why? The alert category had false-positived before, and it didn't page the on-call team at the severity the situation required. The network was finally paused at 06:18:54.
That's alert fatigue hardening into an operational hole. The system saw the attack. The humans didn't get woken up in time.
ICON has since committed to automatic shutdown triggers, lower circuit-breaker thresholds, and a review focused on message uniqueness and replay protection. Good intentions, delivered after the fact. As the authors note, these controls don't replace audits — and they certainly don't replace the thing that actually failed: a process that couldn't escalate a signal to a human fast enough.
There's a second case, aelf, that's quieter and more unsettling. For aelf, the audit evidence simply couldn't be linked to the live attack path at all — a category of exploit that may live permanently outside any audit evidence chain.
The number nobody puts in the headline
Now the contrarian part, because 94.4% is doing an enormous amount of narrative work.
Strip out two large cases — Kelp DAO and Drift — and the out-of-scope share falls to 72.1%. Still damning, but a very different headline. The authors are explicit: no control group, no measurement of exposure duration, no way to prove that out-of-scope status caused each individual loss. The dataset is observational. Private incidents are probably missing entirely, which means the true loss figure is likely higher than the reported $939.86 million.
Then there's the conflict of interest. Two of the authors work at ack3, which sells security review services. "Audits are insufficient" happens to be a thesis that sells the next product. They disclosed it, which counts for something, but a benchmark published by the people selling the alternative is never neutral.
None of this invalidates the ICON finding. The signature gap is real, verified, and mechanistically clear. It just means you should read 94.4% as a provocation, not a proof — and watch how quickly media outlets reach for the bigger number.
Where this actually lands
What the report really documents is the slow death of the point-in-time audit as a trust primitive, and the rise of a harder question: how fast does detection convert into containment?
That's an operational metric, not a marketing one. It rewards real-time monitoring, cross-component integration testing, and on-call discipline over a signed PDF. The security narrative is already migrating from "audit" toward "monitor and insure."
So when the next audited protocol posts its badge and raises a round, ask the uncomfortable question. Not whether the code was checked. Ask which end of the system decided what "unique" meant — and who was awake when it broke.