Audit Badges Hide 49.6% Human-Vector Losses

Woofun AI reports that the 'Audited' badge displayed on protocol websites creates a dangerous illusion of safety, misleading users into believing their funds are protected by competent operators and end-to-end software checks. This perception is reinforced by the presence of a security firm logo and a link to a PDF report, which users interpret as a guarantee of holistic security.

However, the actual engagement often covers only a limited subset of files from one repository during a single week, failing to address the broader operational risks that ultimately compromise user assets.

The scope of these audits is inherently limited, resembling a building owner hiring an electrician to inspect the breaker box while advertising the certificate as proof that the entire property is burglar-proof. The electrician may perform excellent work on the electrical system, but the certificate does not cover doors, alarms, or guards, which were never part of the paid inspection. Similarly, later edits, production configuration, an employee's laptop, cloud accounts, signing devices, and the user interface require separate reviews that fall outside the finite perimeter of a standard code audit. This distortion occurs when a carefully limited report is promoted on a project website as a general claim about the organization's overall security posture.

Audit findings primarily reflect defects identified during code reviews, with logic and business-logic defects accounting for 14.6% of the total, followed by code-quality problems at 13%, input-validation flaws at 10%, and access-control issues at 9.8%. Approximately one in six findings was rated critical or high, resulting in 1,439 critical issues and 2,659 high-severity ones across the dataset. It is crucial to distinguish between an audit finding, which describes a defect found during review, and an exploit loss, which records a successful theft from a live system. Many findings were fixed before deployment, and some vulnerable code never reached production, meaning these two datasets describe different populations and their percentages are not conversion rates.

When placed side by side, the rankings reveal a significant gap between code quality and actual losses. The three leading audit categories account for 37.6% of published findings, while private-key theft and phishing, which are largely outside conventional contract review, account for 43.9% of stolen value. Adding dependency and governance attacks expands the paper's 'human-vector' category to 49.6% of all losses. These failures originate in people, operations, and third-party systems that a standard code review was not hired to inspect, highlighting that nearly half of all crypto losses stem from vectors unrelated to smart contract code quality.

Woofun AI data shows that Bybit serves as a critical case study, supplying $1.43 billion of the $1.51 billion phishing total and representing 18.4% of every dollar in the incident dataset. Eight incidents produced half of all losses, leaving the other 210 incidents to share the remainder, illustrating that crypto theft is a market of catastrophic outliers where one enormous event can rearrange an entire category. Despite this outlier effect, the broader pattern extends beyond Bybit, as private-key compromise appeared across 45 incidents, making it the most expensive root cause even before phishing was included in the calculation. From 2023 through 2025, attacks involving keys, people, dependencies, or governance absorbed between roughly two-thirds and three-quarters of the value lost each year.

A smart contract is merely one room in a huge house, accessed by users through a website and wallet, and often dependent on outside price data before it can act. Multisig procedures govern sensitive transfers, and admin permissions decide who can alter the software, creating a structure that users experience as a single product but attackers see as a collection of doors guarded by different people and software. Bybit's onchain components carried out a properly signed transaction, but the failure began on a developer machine that shaped the proposal and passed through an interface that misled signers into approving something routine. Safe rebuilt its infrastructure, rotated credentials, and committed to making transactions easier to verify, demonstrating that operational and interface repairs are necessary even when valid onchain code has faithfully executed.

The preprint data indicates that 105 of the 218 incidents involved a protocol with at least one public audit before the event, representing about $4.3 billion or 55% of observed losses, a statistic practically engineered for misuse. This does not establish that auditors missed $4.3 billion of exploitable code, as 'Previously audited' can describe another version, another set of contracts, or a review unrelated to the eventual route into the system. Nine of the 12 largest cases in that group came through phishing, stolen keys, dependencies, infrastructure, or governance, rather than code defects. For Nomad, Euler, and others, the paper found later code, excluded paths, or other differences between the reviewed material and the software that eventually held funds, meaning calling all of this an audit failure would make the same scope error the paper is trying to expose.

A skeptical interpretation of the research is warranted because it is a preprint written by someone inside the audit industry, with 22 firms unnamed, which blocks firm-level checks. The incident set comes from one publisher's archive, and PDF extraction makes classification murkier, with part of the process done with an LLM under human oversight. The paper also lacks a matched population of unaudited protocols, making it impossible to calculate how much protection an audit provided. Valuable projects tend to buy more audits and attract more capable attackers, so their presence on both sides of the dataset tells us absolutely nothing about cause and effect,

The strongest claim is that crypto has become good at commissioning one type of inspection and bad at telling users where that inspection ends. An audit firm can review contracts competently, and a custody vendor can secure keys exactly as promised, while cloud providers, monitoring companies, and bug-bounty platforms deliver their assigned pieces.

However, the full path from a developer's laptop to a signer's screen and finally to the deployed code often goes untested, even when public-facing audit language treats security as a certificate attached to a repository. A standardized security label would make the missing work visible, especially when a project has paid for contract review and skipped everything surrounding it, including the audited commit, review dates, included contracts, unresolved critical or high findings, and whether the deployed bytecode matches the reviewed version.

Production configuration needs its own verification date, so a user can tell whether the report applies to the software holding funds today, while key management and signer procedures deserve a separate assessment. Front-end infrastructure and cloud access need another evaluation, and build systems should show whether releases can be altered by one compromised machine. Monitoring and incident exercises should carry dates because both decay as staff, vendors, and software evolve, and a material release would expire the relevant entries until they were tested again. The next 'audited' badge beneath a token launch or beside a deposit button should come with a precise description of what was reviewed, what was excluded, and how long the work still applies, describing the inspection that took place and naming every major system left beyond it, instead of serving as a promise no professional was hired to make.