Study finds $885 million in DeFi losses occurred outside audit scopes

A research paper from ack3 and the Czech Technical University in Prague analyzed 135 DeFi security incidents from the first half of 2026. Among 68 incidents with identifiable audits, 46 attack paths fell entirely outside the scope of those audits. These outside-scope incidents accounted for 94.4% of the losses within that subset, totaling $680.97 million. The study highlights that an audit does not necessarily cover the entire live system or the specific paths where user funds are held.