A new study from security firm ack3 and Czech Technical University in Prague has quantified a fundamental assurance problem in decentralized finance: audits typically cover specific code versions and components at a point in time, but attacks often exploit systems, upgrades, or operational layers that fall outside those defined boundaries.
Researchers examined 135 reported DeFi incidents from January through June 2026, representing $939.86 million in attributed losses. Among the 68 incidents with identifiable public pre-incident audits, they classified 46 attack paths as outside every audit scope identified, 20 as inside at least one scope, and 2 as unresolved. The outside-scope incidents represented 67.6% of the incidents but 94.4% of their reported losses.
Two cases significantly influenced these figures. Excluding $292 million in losses at Kelp DAO and $285 million at Drift Protocol reduced the outside-scope loss share to 72.1% within the same audited-incident subset. The researchers classified 122 incidents as confirmed and 13 as likely, while 35 had no identified audit and 32 had unknown audit histories.
Audit Scope vs. Live Systems
The study illustrates that a project can truthfully claim it was audited while leaving users unable to determine whether the deployed system, the specific code paths holding their funds, or the operational controls around them were actually reviewed. An audit badge does not indicate whether upgrades, privileged keys, front ends, relayers, oracles, cloud services, or incident-response processes received security review.
The August 2026 ICON Network exploit demonstrated this boundary problem directly. In a replay attack on August 27, two parts of a withdrawal path interpreted the same message differently. ICON's migration contract used high bits of a withdrawal message's serial number to determine uniqueness, while the cryptographic signature covered only the low 256 bits. An attacker changed the unsigned high bits to resubmit legitimately signed withdrawal messages 1,492 times over approximately 20 minutes, with 1,490 calls succeeding.
The incident released 119.866 million ICX and 531,600 bnUSD. ICON confirmed net losses of approximately 150.2 ETH plus 31,204 USDC, though it reported that 531,600 bnUSD and 1.366 million SODA were recovered and user deposits and positions were not affected. ICON stated the migration contract had undergone external audit with recommendations implemented in the same area, and that relay logic received dedicated review. However, the postmortem found that the precise mismatch between the uniqueness check and the signed value fell outside those audit findings.
Detection and Response Boundaries
The ICON incident also revealed operational gaps. The first automated alert fired approximately seven minutes after the exploit began, but staff did not open an investigation until 03:40 UTC, paused the affected contract at 03:53, and halted the network at 06:18:54—roughly 90 minutes after initial detection. ICON attributed this delay to alert tuning that had produced false positives during unrelated incidents and did not page the on-call team at appropriate severity. The foundation announced plans for automatic shutdown triggers, lower circuit-breaker thresholds, and a follow-up review on message uniqueness and replay guards.
Limitations and Implications
The study lacks a comparison group of unaudited protocols and does not measure how long each system was exposed. It cannot establish whether audited protocols are safer overall, estimate incident probability, or prove that falling outside scope caused each loss. Undisclosed audits and private incidents may be missing from the analysis, and reported loss figures are not perfectly comparable across incidents.
The researchers concluded their work supports a limited but important distinction: audit history and audit scope are separate variables. A second case, the aelf August incident involving runtime code execution, demonstrated why assurance records must remain current and specific. aelf's security documentation states its contracts underwent multiple audits with no issues identified, but available public pages do not connect specific pre-incident reports to the runtime path exploited in August.
Users attempting to evaluate security assurance need four specific answers: which repository, commit, deployed address and component were reviewed; were fixes deployed and what changed afterward; which alerts page a human or stop the affected path automatically; and which assets are confirmed recovered, frozen, exposed or still under investigation. Without this level of specificity and versioning, audit claims become detached from a system's current code, dependencies, and operational state.
