Audited DeFi Projects Lost $885M to Off-Scope Attacks
A new study reveals that most DeFi exploit losses hit areas security firms were never hired to inspect.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Audited DeFi protocols lost $885 million to exploits that occurred outside their audit scopes.
- Outside-scope attacks accounted for 72.1% of losses after adjusting for two early 2026 outliers.
- Traditional smart contract audits routinely miss critical off-chain and operational security risks.
A clean smart contract audit won't save a DeFi protocol if hackers target everything surrounding it. According to a new preprint paper affiliated with security research group ack3, audited projects lost $885 million to exploits that fell completely outside the scope of their security reviews.
The blind spot in protocol security
Exclude two massive outlier attacks from the first half of 2026, and off-scope vulnerabilities accounted for 72.1% of total protocol losses. Additional security incidents in August only reinforced this trend. Operational missteps routinely render clean code reviews irrelevant.
Audits focus tightly on on-chain smart contracts. Attackers don't care. They take the path of least resistance. If key management breaks, off-chain infrastructure fails, or a third-party integration gets compromised, a flawless audit report offers zero protection.
Why it matters
If you're depositing capital in DeFi, a completed audit isn't a safety guarantee. It just means somebody checked a specific set of code on a specific day. Projects love flashing audit certificates while neglecting operational security, leaving user funds exposed. You need to look past the audit PDF. Check how the team manages admin keys, frontends, and external dependencies before locking up your money.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇪🇸 Showing sites that accept players from Spain Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-facing book that pays a premium for crypto deposits: 125% against 100% for cash, with fee-free deposits across five coins.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
More info Less info
Why we chose it: Phemex is a derivatives-first venue for Europe, Asia and Latin America. Good engine, mid-size liquidity, and a blocklist that grew in 2025.
- Online since
- 2019
- Licence
- Seychelles
- KYC
- Required
Restricted countries: United Arab Emirates, Afghanistan, Australia, Belgium, Bermuda, Belarus, Ontario (Canada), China and 18 more.
More info Less info
Why we chose it: BetNow's casino floor with the biggest match bonus we list. The 200% headline deserves a careful read of the code terms behind it.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
