Gas fees don't lie. Neither do signatures — but only the part of them that gets signed.
On January 1, 2026, a relayer on the ICON network began accepting withdrawal messages it should have rejected. By 02:08 UTC the automated alarm fired, roughly seven minutes after the first malicious transaction landed. By 06:18:54 the entire network was paused. In the ninety minutes between detection and containment, an attacker replayed a single cross-chain message 1,492 times. 1,490 of those attempts succeeded. The ledger keeps score: 119,866,000 ICX and 531,600 bnUSD were minted out of nothing. Minted nothing, promised everything.
That sequence — a signed message, a uniqueness check, and a gap between them — is the whole story of DeFi security in 2026. Not the hacks you read about. The hacks that were fully audited before they happened.
Context
A six-page preprint landed this year, co-produced by ack3 and Czech Technical University. It does something the industry has avoided: it classifies DeFi losses not by exploit type, but by audit timing. Two axes. Was there a prior audit? Did the attack path fall inside the audited scope?
The dataset covers 135 incidents and $939,86 million in attributed losses across the first half of 2026, January 1 to June 29. The headline finding: 94.4% of that money was lost to attacks that occurred outside the scope of any prior audit. Strip out two outsized cases — Kelp DAO and Drift — and the number settles at 72.1%.
The authors are careful. Explicitly, almost defensively careful: the figure "is not an estimate of audit effectiveness." No control group. No measurement of exposure duration. No causal claim. The methodology is observational, the preprint is unrefereed, and two of the authors draw salaries from ack3 — a firm that sells the exact kind of continuous security review the paper implicitly recommends. That disclosure is in the document. I'll come back to it.
What the paper actually delivers is not a verdict on auditors. It's a map of the boundary. Audits cover a specific code, a specific component, a specific version, at a specific point in time. Everything that lives outside that frozen frame — upgrade paths, privileged keys, relayers, oracles, front-ends, cloud infrastructure, incident response — operates in a jurisdiction the auditor never visited.
Core
Start with ICON, because ICON is where the abstraction becomes a defect you can point at.
The migration contract used the high bits of a withdrawal message's serial number to decide whether that message was unique. Standard replay protection. Familiar pattern. But the cryptographic signature on that same message only covered the low 256 bits. The high bits sit outside the signed region. Meaning: an attacker can mutate the high bits — the very field the uniqueness check reads — without invalidating the signature. The check and the proof were looking at two different things.
This is domain separation failure plus missing input validation, stacked. A low-level flaw, not an architectural one. The kind of thing a fuzzing harness catches in an afternoon if anyone points it at the message parser. Based on my own audit work since 2017, this is the recurring sin of bridge design: partial signatures over composite message formats. Sign the body, forget the envelope.
Here is the part that should end arguments. SODAX's audit archive contained eight separate reports spanning multiple components, including a relayer audit from November 2025 — two months before the attack. Eight documents. Different firms, different scopes, different checklists. And not one of them asked the only question that mattered: do the two ends of this message agree on what "unique" means? The uniqueness check lives on one component. The signature lives on another. Nobody audited the seam. The gap between two audited components is itself an unaudited component.
That is the structural finding. Not that auditors are incompetent. That multi-report audit mosaics create governed territory inside each tile and lawless space between them.
Now the response side, because prevention failing is expected and containment failing is a choice. The alarm fired at 02:08 UTC, seven minutes after the attack began — genuinely fast. It was then ignored. The preprint notes the alert category had previously generated false positives, so it was not escalated at the required severity. Nobody called the on-call team. The full response took roughly ninety minutes. The network was not paused until 06:18:54.
Alert fatigue. A tuning problem dressed up as a process. This is the mechanical cruelty of the system: the detection worked, the humans didn't, and the attacker kept replaying a message that should have failed on attempt one.
Then aelf — the control case. Unlike ICON, where audited code failed exactly at its boundary, aelf represents the opposite: current audit evidence cannot be correlated to the attack path at all. Two distinct failure modes. ICON tells you the scope has edges. aelf tells you some attack paths live permanently outside every evidence chain anyone has constructed.
On the money itself, the nominal-versus-net spread is instructive. The bridge released 119,866,000 ICX and 531,600 bnUSD — a nine-figure notional event. Net loss: roughly 150.2 ETH plus 31,204 USDC. 531,600 bnUSD and 1,366,000 SODA were clawed back. So the headline number is theater. What the recovery reveals is more interesting: bnUSD and SODA were recoverable, which means they carry centralized freeze or issuer-intervention capability. The decentralization narrative has a kill switch, and in ICON's case it worked.
Recovery is not a feature of decentralization. It is a feature of someone still holding the keys.
Contrarian
Here's where the bulls get it right, and where I part with the reflexive cynicism the preprint invites.
The 94.4% number is being read — already, on crypto-Twitter, in group chats I'm in — as proof that audits are worthless. That reading is lazy and the authors nearly beg against it. Two incidents, Kelp DAO and Drift, drive the number from 72.1% to 94.4%. Twenty-two percentage points on two coincidences. Remove them and the finding is still alarming but no longer apocalyptic. The data has no control group, cannot establish that any individual loss would have been prevented by a wider audit, and likely undercounts private incidents that never surfaced publicly. The real loss figure may exceed $939,86 million. The preprint says so.
And the contract-audit model is not broken. It is mislabeled. A token audit that catches a reentrancy bug in the transfer logic did its job. The failure is that the industry sold "audited" as a state of the system rather than a timestamp on one artifact. That's a marketing failure, not an engineering one. Code is truth. Intent is fiction. And the fiction that a June audit covers a December upgrade was written by the projects, not the auditors.
So yes — the professionals did the work they were contracted to do. The lie was in the badge.
The commercial angle deserves scrutiny, though, precisely because it's the bulls' blind spot on the other side. Two ack3 employees co-authored a study concluding that point-in-time audits miss catastrophic losses, published by a firm selling continuous review. The disclosure is present, which buys credibility, but the incentive shape is obvious: the paper doubles as market-creation for a product category — post-audit assessment, real-time monitoring, event-response retainers. Every bear citation of this study is unpaid advertising for ack3. That doesn't make the ICON analysis wrong. It makes the framing useful to someone.
Takeaway
ICON's own remediation plan tells you what the industry actually learned. Auto-shutdown triggers. Lower circuit-breaker thresholds. A fresh review focused on message uniqueness and replay protection. All sensible. All corrective. And none of it substitutes for an audit that would have caught the sign/verify mismatch in the first place.
The deeper lesson is about time. An audit is a photograph. A protocol is a motion picture. The photograph can be perfect and still describe nothing about the frame that kills you. What the next cycle will price — and what ack3 is quietly positioning for — is the difference between certifying a moment and monitoring a running system.
Watch for the phrase "continuously audited" in 2026 pitch decks. When you see it, ask a narrower question: which component, which version, and what happens at the seam between your two favorite auditors?
Gas fees don't lie. But signatures only cover the bits they were told to. Everything else is fiction, and the ledger keeps score."