Do Audits Prevent Hacks? What the Loss Data Shows
Quick answer. Not on their own: a 2026 study of over 4,000 DeFi protocols found having an audit at launch was not significantly linked to fewer breaches. At audited victims, most losses came through keys, signers or code outside audit scope.
Video transcript
Do audits prevent hacks? Not on their own. Most money lost at audited protocols left through keys, signers or unreviewed code.
An audit covers named files at one commit, at one point in time. It is not cover for code written later.
By Guardian's sum of ack3's 2026 ledger, about 92.6 percent of known losses at audited victims came from outside audit scope.
Among the 20 largest DeFi hacks, six audited protocols lost about 710 million dollars through keys, signers or infrastructure. Others fell to code outside scope or changed after the audit.
In a 2026 study of more than 4,000 protocols, an audit at launch was not significantly linked to fewer breaches. Its working paper tied top-tier audits and bounties to fewer, smaller breaches. These are observational estimates.
Each layer catches what others miss: two independent teams, one running Guardian's Helix AI auditor, then invariant fuzzing, fix review for every change, and a bug bounty after launch.
Guardian's Vanguard adds a public contest, a hosted bounty with Critical matching, and six months of review for changes to the audited scope, within stated limits.
Buy coverage, not a badge. Ask for files, libraries and a commit hash, review of every fix, and separate scoping for keys and signers.
Read the full article for the data and checklist, or talk to Guardian about an audit paired with offchain and OpSec reviews.
The Short Answer
No, not on their own. Ethereum.org says audits raise the chance of finding bugs but will not catch every bug. Ethereum.org
An audit reviews named files at one commit, at one point in time. It is not cover for the whole project or for code written later. arXiv, Ethereum.org
Across the public counts, most money lost at audited protocols left through paths outside that review. arXiv, ack3, Guardian Resource Hub, ack3
In ack3's H1 2026 study of 135 incidents, outside-scope paths carried 94.4% of losses where audit history was known, and 72.1% without its two largest incidents. arXiv
Half of Guardian's 512 incidents hit protocols missing from DefiLlama's listing, so their audit status is unknown. Our audited vs unaudited exploits analysis holds the incident tables. Guardian Resource Hub
These ledgers count hacked protocols only, so they cannot measure how much an audit lowers the odds of a hack. Guardian Resource Hub
A study in the Journal of Accounting and Economics (2026) tried. It covers more than 4,000 DeFi protocols launched from 2020 to 2025, unhacked ones included. Duke University Scholars
Having an audit at launch was not significantly associated with later breach odds or hack-related losses. Duke University Scholars
Its October 2025 working-paper version also linked top-tier audits to lower breach odds and smaller losses when breached. Wharton-hosted working paper
These are observational estimates from one study, not proof that a given audit will work. Wharton-hosted working paper
| Dataset | Window | Result |
|---|---|---|
| Guardian, DefiLlama listing | Jan 1, 2024 to Nov 2, 2026 | 156 of 512 hacks hit listed-audited protocols: 48.6% of losses |
| Guardian, top 20 checked by hand | Jan 1, 2024 to Nov 2, 2026 | 13 audited; 77% of their losses came outside audited code |
| ack3 H1 2026 study | Jan 1 to Jun 29, 2026 | 46 of 68 audited-history incidents outside every scope; 94.4% of losses |
| ack3 incident ledger v2.0 | Jan 1 to Sep 30, 2026 | 106 of 148 audited victims outside scope: 92.6% of known losses, Guardian sum |
What Audits Catch and Miss
Inside scope, audits find serious bugs. Guardian's Dolomite GMX V2 module review recorded six High or Critical issues in its main review. Guardian
The remediation review then found three Critical issues in later code changes. A fix is new code and needs the same scrutiny. Guardian
Audits also miss bugs in code they cover. ack3's 2026 ledger counts 35 incidents where the exploited path sat inside a confirmed or probable audit scope. ack3
By Guardian's sum of ack3's published data, those 35 carried about $56.2 million, or 5.5% of known audited-victim losses. ack3
The bigger gap is what never entered scope. On May 22, 2025, Cetus lost about $223 million through a bug in integer-mate, a math library its pools relied on. Guardian Resource Hub, Rekt
Zellic told Rekt the library was not in its audit scope. Cetus released checked_shlw fixes to integer-mate on GitHub the same day. Rekt, CetusProtocol on GitHub
Our Cetus hack breakdown has the overflow check details. Code and systems that commonly sit outside an audit:
- Libraries and dependencies missing from the file list, as at Cetus. Guardian Resource Hub, Rekt
- Fixes and upgrades shipped after the final reviewed commit. Guardian Resource Hub, Guardian
- Integrations the audit assumed would behave, rather than tested.
- Keys, signers, cloud accounts and build pipelines, which are not contract code. Guardian Resource Hub
Offchain Causes Audits Do Not Cover
Many of the largest losses at audited protocols never touched a contract bug. Guardian's hand check of the 20 largest DeFi hacks shows why. Guardian Resource Hub
Among those audited, six lost about $710 million through keys, signers or infrastructure. Two lost $268 million through code outside scope, and one lost $42 million through code changed after the audit. Guardian Resource Hub
Guardian's audit page lists these surfaces as separate engagements: infrastructure, API, web app, automation and OpSec. Guardian
Scope them alongside the audit. Our audit vs pentest guide shows how to split one threat model between both.
| Cause | Case in the data | Separate review |
|---|---|---|
| Signers tricked into pre-signing | Drift, April 2026 | OpSec audit |
| Signer devices compromised | Radiant, October 2024 | OpSec audit |
| Key stolen through CI/CD | Resolv, March 2026 | Infrastructure pentest |
| Bridge trusting a single verifier | Kelp DAO, April 2026 | OpSec audit |
| Offchain price infrastructure | Ostium, July 2026 | Offchain automation pentest |
| Five of seven validator keys used | AFX, July 2026 | OpSec audit |
What Layered Programs Add
No dataset here ranks layers by hacks prevented. Each layer earns its place by catching what the others structurally miss.
Two teams on one scope give two independent reads of the same commit. Guardian pairs manual review and fuzzing with a second team running Helix, its AI auditor. Guardian
Each team cross-checks the other, and only human-verified findings reach the report. Guardian
Invariant fuzzing turns safety properties into tests. Ethereum.org describes fuzzing as running contracts with random inputs to find violations of stated properties. Ethereum.org
Guardian's suite fuzzes accounting, solvency and rounding across reachable states. It stays with your team for every later change. Guardian
In DollarStore's October 2026 fix review, fuzzing found that a fix made swaps through a paused or off-peg asset fail with a generic liquidity-shortage error instead of naming the cause. Guardian
The finding was Informational, with no funds at risk, and unresolved in the report. Guardian
Bug bounties extend review to independent researchers after launch, Ethereum.org notes. Ethereum.org
In the study's October 2025 working paper, decentralized bounty audits were linked to fewer and smaller breaches. Its published abstract adds that hacked protocols often hired decentralized auditors afterward. Wharton-hosted working paper, Duke University Scholars
Vanguard, Guardian's enterprise audit, adds a public contest with a $100,000 Critical pot funded by Guardian, and a hosted bounty with $50,000 of Critical matching. Guardian
It also includes six months of review for changes to the audited scope, within stated SLOC limits. Guardian
Buying an Audit That Works
Buy coverage, not a badge. These checks apply to any firm, Guardian included.
For how many reviews to buy by novelty, value and change rate, see how many audits a protocol needs.
| Check | Evidence to ask for | Red flag |
|---|---|---|
| Scope | File list, libraries and commit hash | Core contracts named, no files listed |
| Dependencies | Which libraries and integrations are in or out | Shared math libraries left out silently |
| Methods | Manual, fuzzing and AI passes, and who verifies findings | Unverified tool output in the report |
| Invariants | Written safety properties and the runnable suite | No properties, or the suite stays with the vendor |
| Fix review | Every fix reviewed at a named commit | Fixes merged after the final report |
| Later changes | A plan and price for each upgrade | An old report cited for new code |
| Deployment | Deployed bytecode matched to the final commit | No commit hash anywhere in the report |
| Offchain | Keys, signers, CI/CD and keepers scoped separately | An audit sold as full-system cover |
| After launch | A bug bounty sized to funds at stake | No bounty or response plan |
Frequently Asked Questions
How many DeFi protocols get an audit before launch?
In the October 2025 working-paper sample of the Journal of Accounting and Economics study, about 46% of protocols engaged an auditor before launch and 23% hired a top-tier firm. The published abstract does not restate these shares. Wharton-hosted working paper
Does formal verification replace an audit?
No. Ethereum.org notes that formal verification proves only the model you specify, so a wrong or missing property still passes. It presents testing, audits and bug bounties as layers that complement each other. Ethereum.org, Ethereum.org
What happens if an audited protocol is hacked anyway?
Outcomes vary by chain and team. After Cetus, Decrypt reported that validators froze about $162 million, the Sui Foundation lent $30 million, and pools reopened in June 2025 with 85% to 99% of liquidity restored. Decrypt, Rekt
Related reading
- audited vs unaudited exploits
- how many audits does a protocol need
- smart contract audit vs pentest
- cetus hack explained
- smart contract security
Sources
- arXiv: The ack3 H1 2026 DeFi Incident Dataset: Audit Scope Across 135 Security Incidents
- ack3: DeFi hacks Q1–Q3 2026: verified incident ledger, dataset v2.0
- Guardian Resource Hub: Were Hacked Protocols Audited? Audited vs Unaudited Exploits
- Guardian Resource Hub: The Cetus Hack on Sui Explained: A Faulty Overflow Check
- Rekt: Cetus
- Ethereum.org: Smart contract security
- Ethereum.org: Testing smart contracts
- Guardian: Dolomite GMX V2 Module Audit Report
- Guardian: DollarStore Review, remediation finding I-03
- Guardian: Smart Contract Audit
- Decrypt: Sui DeFi Exchange Cetus Back in Action After $233 Million Exploit
- CetusProtocol on GitHub: integer-mate releases: checked_shlw fixes
- Guardian: Vanguard: Enterprise Smart Contract Audit
- Wharton-hosted working paper: Auditing Smart Contracts
- ack3: ack3 DeFi hacks Q1–Q3 2026 dataset JSON, version 2.0
- Duke University Scholars: Auditing smart contracts
- Israeli Research Community Portal, Tel Aviv University: Evgeny Lyandres research record
- National University of Singapore Business School: NUS Business School publications: Auditing smart contracts
- Andreas Park / Slides.com: Auditing Smart Contracts, discussant slides
- Evgeny Lyandres, Tel Aviv University: Auditing decentralized finance (DeFi) protocols
Scope Your Audit to Where Losses Start
Guardian's smart contract audit puts two independent teams on one scope: manual review with the invariant suite, and Helix. Pair it with offchain and OpSec reviews for the keys and systems around your code.