$680 Million Warning: Most DeFi Attacks Occur Outside Audit Scope

A study by security firm ack3 and the Czech Technical University in Prague analyzed 135 security incidents from the first half of 2026, totaling $939.86 million in losses. Among 68 incidents with known audit records, 67.6% of attacks occurred outside the scope of any public audit, accounting for 94.4% of the total losses in that sample. The research highlights that an 'audited' status does not guarantee security for system upgrades, private keys, or front-end infrastructure, as evidenced by the recent ICON Network (ICX) reentrancy attack involving USDC.