More than half of the $939.86 million stolen from crypto protocols in the first half of 2026 came from projects that carried completed security audits, exposing a fundamental flaw in how the industry evaluates risk. The problem isn't that audits are failing to catch bugs in smart contracts. It's that attackers have stopped targeting smart contracts altogether, instead exploiting unreviewed infrastructure, compromised keys, and operational weaknesses that audits never touch.

What Exactly Are Auditors Missing?

A security audit typically covers a specific set of smart contract files at a single point in time. It does not cover the deployment environment, developer workstations, cloud infrastructure, DNS records, or the private keys used to manage protocol parameters. This boundary, called the "scope gap," is where nearly all the money actually disappears.

In the first six months of 2026, 68 audited protocols were breached. Of those, 46 projects fell victim to attack vectors entirely outside the scope of their published audits, resulting in $680.97 million in losses. That represents 94.4% of all financial damage suffered by audited victims. By contrast, the 20 exploits that actually ran through audited code netted attackers just $35.21 million, or 4.9% of total audited losses.

"An audit is a timestamp and a boundary, not a lifetime warranty. The old question was: 'Was it audited?' The useful questions are: 'What exactly was audited, when, and what has changed since?' A contract report cannot protect a leaked signing key, a compromised front end, or a legacy deployment that no longer matches the reviewed code,"

Josef Gattermayer, Founder at ack3

This data comes from ack3, an AI-native cybersecurity firm that has completed 237 protocol reviews since 2021. The firm's H1 2026 security report analyzed 135 verified security incidents across the crypto industry, capturing both on-chain and off-chain breaches.

How Are Attackers Bypassing Audited Code?

Sophisticated threat actors have adapted their tactics. Rather than trying to exploit bugs in reviewed smart contracts, they now systematically target the operational surface surrounding the code. ack3 identified four recurring attack vectors responsible for driving out-of-scope losses:

• Compromised Private Keys and Signing Authorities: Admin keys, multisig signers, and operational hot wallets remain the quickest path to total protocol drain. Once a signing authority is compromised via phishing or poor key management, attackers can upgrade contracts, alter parameters, or trigger emergency mints through legitimate protocol functions, completely bypassing on-chain logic checks.
• Front-End Script Injections and DNS Hijacking: Rather than breaking on-chain logic, attackers hijack the interface users trust. By compromising DNS records or injecting malicious JavaScript via third-party web dependencies, attackers swap target addresses or trick users into signing approvals for malicious spenders while interacting with what appears to be a legitimate user interface.
• CI/CD Pipelines and Cloud Infrastructure Credentials: Attack vectors increasingly route through GitHub Actions, cloud environment variables, and build pipelines. Hardcoded secrets or leaked API keys allow attackers to tamper with build artifacts or access infrastructure assets before code ever touches the blockchain.
• Unreviewed Off-Chain Provers, Relayers, and Cross-Chain Infrastructure: Modern DeFi protocols rely heavily on off-chain components, provers, oracle relayers, zero-knowledge sequencers, and cross-chain messaging bridges. These complex services sit outside standard contract audits, yet they dictate the inputs that trigger on-chain execution. When an off-chain relayer or prover fails, the on-chain contract simply processes the bad state update as instructed.

The pattern is clear: audits have successfully raised the bar for smart contract security, making opportunistic hackers look elsewhere. But that success has created a false sense of security, attracting capital and institutional allocators to audited protocols, which then become high-value targets for sophisticated attackers who know exactly where to look.

Why Does the Audit Illusion Persist?

Capital naturally accumulates where security badges are displayed. Institutional allocators, yield farmers, and retail traders treat an audit report as a green light, driving liquidity into protocols that present a polished security posture. This creates a paradox: audits attract capital, which turns audited protocols into high-value targets. Attackers recognize that smart contracts are often the strongest link in the chain, so they systematically target the operational surface around the code.

The data reveals the disparity between incident counts and financial damage. Audited protocols accounted for 50.4% of all security incidents in H1 2026, but absorbed 76.7% of all stolen capital. Unaudited projects and those with unknown audit histories accounted for a combined 49.6% of incidents but only 23.3% of losses. This suggests that audits do deter opportunistic hackers hunting for low-hanging Solidity bugs, but they fail to address the infrastructure vulnerabilities that sophisticated threat actors exploit.

Steps to Strengthen Web3 Security Beyond Audit Reports

The findings from ack3 suggest that the industry needs to move beyond treating audits as a permanent, binary status. Security must be continuous, comprehensive, and address the entire operational architecture, not just the smart contract code.

• Expand Audit Scope: Security reviews must explicitly cover deployment environments, cloud infrastructure, DNS configurations, key management practices, and off-chain components like relayers and provers, not just isolated smart contract files.
• Implement Continuous Monitoring: Rather than relying on point-in-time assurance, protocols should adopt living security frameworks that track changes to code, infrastructure, and operational procedures after the initial audit is complete.
• Prioritize Operational Security: Protocol teams must invest in private key management, developer workstation hardening, CI/CD pipeline security, and front-end integrity monitoring as aggressively as they invest in smart contract audits.
• Establish Clear Scope Boundaries: When publishing audit reports, protocols should explicitly document what was reviewed, what was excluded, and what has changed since the audit was completed, so users and allocators can make informed risk assessments.

The 2026 data makes one thing clear: the question "Was it audited?" is no longer sufficient. The useful questions are "What exactly was audited, when, and what has changed since?" Until the industry shifts from treating audits as lifetime warranties to treating them as timestamped snapshots of a narrow scope, the $680 million blind spot will remain wide open.

What's Happening at the Ethereum Foundation?

Meanwhile, the Ethereum Foundation is reinforcing its commitment to security at the governance level. Pascal Caversaccio, co-founder of SEAL 911, a 24/7 emergency hotline for active crypto security exploits, has joined the Ethereum Foundation's board of directors, completing a four-member governing body that had shrunk to three after months of departures and restructuring.

Caversaccio's appointment is significant because it places a security-focused researcher at the fiduciary level of the organization responsible for Ethereum's protocol security. Under Swiss foundation law, board members hold the authority to oppose decisions that violate the foundation's mandate, a structural power that no one at the operational level inside the foundation has ever possessed.

SEAL 911 has handled 3,300 support tickets and managed more than 125 war rooms since its official launch. In 2025 alone, the organization handled 1,800 tickets and recovered more than $50 million in crypto assets. The organization operates as a free service, with backing from over 75 Web2 and Web3 companies totaling more than $2.9 million in contributions.