A new academic study of 2026's first-half DeFi hacks finds that once a protocol had a public pre-incident audit, the attacks that actually hit it overwhelmingly struck code, components, or systems the audit never covered. Two case studies, ICON Network and aelf, show what an audit boundary misses in practice, and how long it can take a team to contain a breach once one appears.
A gap between audit and losses
Researchers affiliated with security company ack3 and the Czech Technical University in Prague examined 135 reported DeFi incidents from the first half of 2026, totaling $939.86 million in attributed losses. They found identifiable public pre-incident audits for 68 of those incidents.
Within that 68-incident subset, the researchers classified 46 attack paths as falling outside every audit scope they could identify, 20 as inside at least one scope, and two as unresolved. The outside-scope group made up 67.6% of the incidents but 94.4% of the reported losses in that subset — $680.97 million of $721.24 million.
Two large cases dominate that figure. After excluding $292 million at Kelp DAO and $285 million at Drift Protocol, the outside-scope share falls to 72.1% of losses in the same subset, or $103.97 million of $144.24 million. The researchers note the study cannot establish that falling outside audit scope caused each loss, only that the two variables often diverge.
ICON's replay exploit slipped through a signature gap
ICON Network's Aug. 27 replay exploit shows how a reviewed system can still fail at the seam between two checks. According to the ICON Foundation's postmortem, a migration contract used the high bits of a withdrawal message's serial number to judge uniqueness, while the cryptographic signature covered only the low 256 bits. An attacker exploited that mismatch to resubmit two signed withdrawal messages 1,492 times over about 20 minutes, with 1,490 calls succeeding.
The replays released 119.866 million ICX and 531,600 bnUSD. ICON put the confirmed net loss at about 150.2 ETH plus 31,204 USDC, and said 531,600 bnUSD and 1.366 million SODA had since been recovered. The migration contract had undergone an external audit with the recommendations implemented, and the relay logic had its own dedicated review — but the specific mismatch between the uniqueness check and the signed value fell outside those findings.
Detection also lagged: ICON's first alert fired at 02:08 UTC, about seven minutes into the exploit; staff opened an investigation around 03:40, paused the affected contract at 03:53, and halted the network at 06:18:54. ICON attributed the delay to alert tuning, since the alert class had produced false positives during unrelated connectivity incidents.
aelf's runtime breach still can't be tied to an audit
aelf's August incident cuts the other way. The company announced a network pause on Aug. 18, and its Aug. 26 update said an unauthorized smart contract had used transaction parameters to push encoded .NET assemblies into the node execution path. aelf identified 155 associated transactions and five unique payload assemblies capable of host command execution and node-key access, though it said this did not prove every assembly ran or that data was exfiltrated.
As of Sept. 11, aelf's public status remained provisional, with no incident-specific update since Aug. 26. Its standing security documentation says the network's contracts underwent multiple audits with no issues found, but the available material does not connect a specific pre-incident report to the runtime path described in August.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
