Crypto▼ Bearish
Why crypto 'audited' badges give investors a false sense of security
The Bybit $1.46B hack exposed how "audited" badges mask gaps between code review and real security. A new study shows 49.6% of losses come from human vectors audits miss.
Continue with
At 1:30 p.m. UTC on Feb. 21, 2025, Bybit began moving funds from an Ethereum cold wallet to a warm wallet. Authorized signers reviewed the destination on their screens and approved it. The screens were lying.
Bybit later said the signing interface had been manipulated so the signers saw the address they expected while the transaction underneath gave an attacker control of the wallet. The exchange put the loss at $1.46 billion. The FBI attributed the theft to North Korea.
Safe, the multisig provider, said a compromised developer machine enabled a disguised malicious transaction. External researchers found no vulnerability in Safe's smart contracts or the source code for its front end and services. The private keys never left their devices. Valid signatures were enough once the humans producing them had been shown a false description of what they were authorizing.
Every line of the relevant contracts could be reviewed. A human still had to decide what the screen meant. That distance between code and intent is where crypto's most reassuring security word begins to fall apart.
The gap between audit and exploit
The term "Audited" appears on protocol websites as a badge, usually beside a security firm's logo and a link to a PDF. Users read that badge as shorthand for safe funds and software checked from end to end. The engagement behind it may have covered several files from one repository during one week.
Think of a building owner hiring an electrician to inspect the breaker box, then advertising the certificate as proof the whole property is burglar-proof. The electrician did excellent work. The certificate has been promoted into a promise about doors, alarms, and guards the electrician was never paid to inspect.
Smart-contract auditors describe their assignments with more precision than the projects marketing them. An OpenZeppelin report identifies four pull requests by commit hash, names the contracts included, and records a three-day review period. A commit hash is the fingerprint of one code snapshot. Once the code moves on, the report does not automatically move with it.
Later edits and the configuration used in production may receive separate testing. An employee's laptop or cloud account belongs to another layer. Signing devices and the interface explaining a transaction require their own review. The arrangement is normal professional practice. A finite engagement needs a finite perimeter.
The distortion begins when a carefully limited report reaches a project website and becomes a general claim about the organization operating the code.
A June preprint by Oak Security's Stefan Beyer gives that gap a very large set of numbers. Beyer examined 23,818 public findings from 22 security firms, then compared them with 218 incidents cataloged by rekt.news between Jan. 1, 2022, and March 27, 2026. Those incidents produced an estimated $7.764 billion in losses.
The audit findings look like the output of people hired to inspect code. Logic and business-logic defects made up 14.6% of the total. Code-quality problems accounted for 13%. Input-validation flaws contributed 10%. Access-control issues were close behind at 9.8%. Around one in six findings was rated critical or high, giving the dataset 1,439 critical issues and 2,659 high-severity ones.
An audit finding describes a defect found during a review. An exploit loss records a successful theft from a live system. Many findings were fixed before deployment. Some vulnerable code never reached production. The two datasets describe different populations, so their percentages are not conversion rates.
Placed next to each other, the rankings show the gap. The three leading audit categories account for 37.6% of published findings. Private-key theft and phishing, both largely outside conventional contract review, account for 43.9% of stolen value.
Adding dependency and governance attacks takes the paper's "human-vector" category to 49.6% of losses. Those failures begin in people, operations, and third-party systems that a standard code review was not hired to inspect.
That 49.6% number needs a warning label of its own. Bybit supplied $1.43 billion of the $1.51 billion phishing total and 18.4% of every dollar in the incident dataset. Eight incidents produced half of all losses. The other 210 shared the remainder.
Crypto theft is a market of catastrophic outliers. One enormous event can rearrange an entire category.
Nonetheless, the broader pattern extends beyond Bybit. Private-key compromise appeared across 45 incidents, making it the most expensive root cause even before phishing entered the calculation.