Were Hacked Protocols Audited? Audited vs Unaudited Exploits

Video transcript

Were hacked DeFi protocols audited? Many were. But the audit badge says little about how the money was lost.

Across 512 DeFi hacks since 2024, about 30 percent hit protocols DefiLlama lists as audited, holding 49 percent of losses. Half are unlisted.

We count hacked protocols only, so this cannot show whether audits lower the odds of a hack.

We then checked the 20 largest hacks by hand. 13 of them had a published audit before the hack.

Six lost funds through keys, signers and infrastructure. Two through code outside the audited scope, one through code changed after the audit. Balancer's scope is contested, and three have no stated scope.

In total, 77 percent of their losses came through offchain systems or code the audit did not cover.

At Cetus, Zellic said the library holding the bug was not included in its audit scope. That audit had finished 41 days earlier.

Audits also age. GMX V1's bug came from a later fix, and its latest audit was about 33 months old.

Before investing, read the scope, not the badge. Check the deployed code matches, what changed since, who can upgrade, which verifiers are trusted, where keys live, and what is monitored.

Vanguard pairs two audit teams with invariant fuzzing, then reviews every update for six months. Read the full article, or get a quote at guardian.security.

The published numbers conflict. In Halborn's top 100 DeFi hacks from 2014 to 2024, only 20% of the hacked protocols were audited, and they held 10.8% of the value lost.

A study of H1 2026 by ack3 and Czech Technical University found that, where a hacked protocol had an audit history, most attack paths fell outside every identified audit scope.

Both can be true. We counted DeFi hacks from 2024 to 2026, then checked the 20 largest by hand to see what the audit actually covered.

What Counts as Audited

We used three tests, from broad to strict.

• Listing test: DefiLlama's protocol listing carries an audit code and audit links for each protocol. We matched every hack to it.
• Hand test: for the 20 largest hacks, we looked for a public audit report dated before the incident.
• Scope test: for those 20, we checked post-mortems, auditors and Rekt to see whether the exploited path was in scope.

Data and limits

• Hacks: DefiLlama's dataset, pulled November 4, 2026. We kept the 512 incidents it labels DeFi Protocol, January 1, 2024 to November 2, 2026.
• Listing: DefiLlama's protocol API, same day. Projects supply audit links when they apply to be listed, and the audit code carries no date.
• Gaps: half the hacked protocols are not in the listing, so their audit status is unknown.
• No baseline: we count hacked protocols only, so this cannot show whether audits lower the odds of a hack.

Share of Hacks and Losses

Among protocols DefiLlama does list, 61% of hacks and 70% of losses hit audited ones.

Larger incidents skew audited. 42% of the 36 hacks of $10M or more were listed as audited, against 29% of hacks under $1M.

The audited share of losses rose from 19% in 2024 to 40% in 2025 and 74% in 2026. Drift and Kelp DAO alone carry most of 2026.

The 20 Largest, Checked by Hand

These 20 hacks total $1.86B, 68% of all DeFi protocol losses in the period.

13 of the 20 had a published audit before the hack, holding $1.33B, or 71% of the top-20 losses.

The listing undercounts. DefiLlama lists Cetus, Penpie and Resolv as having no audits, yet each had several audits before its hack.

Inside or Outside the Audit

The audit badge says little about the attack path. Here is how the 13 audited protocols lost their money.

• Keys, signers and infrastructure (6): Drift, Kelp DAO, Radiant, Resolv, AFX and Ostium. $710M.
• Code outside the audited scope (2): Cetus and Hedgey. $268M.
• Code changed after the audit (1): GMX V1. $42M.
• Code in pools listed as audited, contested (1): Balancer V2. $128M.
• Scope not stated in any source (3): Tectonic, Penpie and Thala. $177M.

So 77% of these 13 protocols' losses came through offchain systems, or through code the audit did not cover. Sources do not state the scope for another 13%.

Two cases show the gap. At Cetus, Zellic said the integer-mate library holding the bug "was not included in the scope of our audit." That audit had finished 41 days earlier.

At Hedgey, Consensys Diligence noted mid-review that the exploited ClaimCampaigns contract was "not part of the scope of this review."

Balancer is the contested case. Its own audit list shows 2022 Trail of Bits and Certora reviews of Composable Stable Pools, but Rekt quotes OpenZeppelin saying prior audits did not cover them.

We count Balancer as inside the audit, which keeps the 77% conservative.

Other studies agree

• ack3 (H1 2026): of 68 hacks with a known audit history, 67.6% of attack paths and 94.4% of losses were outside every identified scope.
• Without Kelp DAO and Drift, ack3's out-of-scope loss share is still 72.1%.
• Hacken (Q3 2026): 77% of losses came from compromised suppliers or tools, undeployed fixes or unreviewed components, per Cointelegraph.

Audit Age and Code Drift

An audit covers one commit. Code and configuration keep moving after it.

• GMX V1: PeckShield said the bug "was indeed introduced in the fix for the $1M bounty issue," per Rekt. The latest audit was Quantstamp's, about 33 months before.
• Tectonic: its latest listed audit was April 2023, about 40 months before the exploit.
• Balancer V2: the pool audits Balancer lists were about 37 months old.
• Cetus: the newest audit was only 41 days old. The gap was scope, not age.

Offchain cases can follow fresh audits too. AFX promoted a Zellic audit seven weeks before its validator keys were used, and Resolv's latest audit was in January 2026.

Our posts on when you need a re-audit and whether deployed code matches the audit cover the drift side.

What to Ask Before You Trust an Audit

• Which contracts, libraries and commit were in scope, and what was excluded?
• Does the deployed bytecode match the audited commit?
• What changed since the audit, and who reviewed each change?
• Who can upgrade or pause, with what threshold and timelock?
• Which bridge verifiers, oracles and keepers are trusted, and how many must agree?
• Where do signing keys live, and who can reach them through cloud or CI/CD?
• What is monitored onchain, and who can act within minutes?

Drift's admin multisig ran at 2 of 5 with no timelock, according to Rekt. Neodyme's 2024 audit reviewed the authority structure, and Rekt says it appears to have been treated as an acceptable assumption.

How Guardian Helps

Vanguard pairs two audit teams with invariant fuzzing, then reviews every update to the same scope for six months after production, up to 2,500 smart contract SLOC.

Half the package cost comes back as credits toward offchain assessments, the side where most of these losses began.

After launch, Managed Security reviews every deployment and configuration change as it lands. The year's headline numbers are in our crypto hack statistics.

Frequently Asked Questions

What percentage of hacked DeFi protocols were audited?

In DefiLlama's listing, 30% of DeFi protocol hacks from 2024 to November 2, 2026 hit protocols listed as audited, with 49% of losses. Half are not in the listing. Of the 20 largest hacks, 13 had a published audit.

Why do audited protocols still get hacked?

Mostly through offchain systems or unreviewed code. Of the 13 audited protocols among the 20 largest hacks, six lost funds through keys, signers or infrastructure, and three through code outside the audit or changed after it.

Are unaudited protocols hacked more often?

This data cannot say. It counts hacked protocols only, with no baseline of protocols that were not hacked. The ack3 researchers note the same limit in their H1 2026 study.

How should I check a protocol's audit before investing or integrating?

Read the scope, not the badge. Confirm which contracts, libraries and commit were reviewed, that the deployed code matches, what changed since, and who holds the admin keys and verifier settings.

Sources

• DefiLlama: Hacks dataset API (pulled November 4, 2026)
• DefiLlama: Protocols API with audit codes and links (pulled November 4, 2026)
• DefiLlama: Adapters pull request template, listing fields (accessed November 4, 2026)
• Halborn: The Top 100 DeFi Hacks Report 2025
• Gattermayer, Kalivoda and Bašović (ack3, Czech Technical University): The ack3 H1 2026 DeFi Incident Dataset, arXiv (August 13, 2026)
• Cointelegraph: Bitget, Liquid Exploits Push Q3 Crypto Hacks Toward $1.2B, citing Hacken (October 15, 2026)
• Rekt: Cetus, Rekt (May 2025)
• Consensys Diligence: Hedgey DelegateTokenClaims and VestingLockups audit (April 2024)
• Rekt: GMX, Rekt (July 2025)
• Balancer: V2 audits directory (accessed November 4, 2026)
• Rekt: Balancer, Rekt II (November 2025)
• Rekt: Drift Protocol, Rekt (April 9, 2026)
• Velocity docs: Audits, including pre-fork Drift Protocol v2 reports (accessed November 4, 2026)
• Rekt: KelpDAO, Rekt (April 2026)
• Code4rena: Kelp DAO rsETH Findings and Analysis Report (December 11, 2023)
• Tectonic docs: External Audits (accessed November 4, 2026)
• Resolv docs: Security and audits (accessed November 4, 2026)
• Rekt: Resolv Labs, Rekt (April 7, 2026)
• Rekt: AFX Trade, Rekt (July 2026)
• Rekt: Ostium, Rekt (July 2026)
• Rekt: Leaderboard, with audit status per incident (accessed November 4, 2026)