Most DeFi due diligence still runs on a single question. Has the protocol been audited? The honest answer is that the audit was never built to carry that weight.
CertiK's H1 2025 data tracked $2.47 billion lost across 344 incidents, and the largest share by far came not from broken contract logic but from compromised wallets and signing systems. In many of those cases, the code executed exactly as written.
That gap between "the code is correct" and "the money is safe" is the real subject here. Decentralised finance has matured past the point where a protocol can be judged as a single application.
A live position now leans on oracle feeds, bridges, wrapped assets, a stablecoin issuer, external liquidity, a frontend, and governance decisions made by people the depositor will never meet. Each of those is a separate trust assumption.
None of them shows up on an audit certificate.
Seasoned security researchers stopped treating DeFi as a collection of apps some time ago. They read it as an operating model, a set of connected services that each import their own technical, governance, and operational assumptions. The stronger those connections grow, the less a single audit report or a headline total-value-locked figure says about real exposure.
For an institutional allocator, that reframing changes the diligence question outright. What matters is not whether one contract was reviewed. It is whether the whole arrangement keeps protecting capital when one part of it fails.
The Audit Certifies the Code, Not the System Around It
An audit is a scoped, time-bounded review. OpenZeppelin describes its own process plainly, with at least two engineers reviewing the same code and automated tooling kept separate from human security reasoning. What that produces is a judgement about a defined codebase at a defined moment. It does not stand as a guarantee covering the next upgrade, the next bridge integration, or the oracle the contract trusts for prices.
Consider a lending market whose contracts enforce every rule correctly. An attacker manipulates the external price feed the market relies on, inflates the value of pledged collateral, borrows real assets against it, and walks away leaving bad debt behind. Nothing in the code malfunctioned.
One assumption underneath the code stopped being true.
Flash loans make that scenario cheaper than most investors assume. The Bank of Canada's 2025 work on uncollateralised lending describes how a borrower can take and repay enormous sums inside a single transaction, which removes the capital barrier that once deterred this kind of market manipulation. An attacker no longer needs deep pockets. They need one mispriced dependency and a block to act in.
This is why mature security teams evaluate attack paths, not isolated bugs. As a label, "audited" earns its place as evidence of one control. Treating it as proof that every supporting part has been independently verified is the false confidence that turns a clean report into an expensive surprise.
The Attack Surface Moved Up the Stack
Look at where the losses actually migrated, and the shift is hard to miss. Immunefi's six-year review of DeFi losses found bridge incidents fell from 73% of DeFi losses in 2022 to 3% in 2025, while the damage moved toward signing systems, custody workflows, and privileged access. None of it disappeared. The exploit climbed to a higher, softer layer.
CertiK's data tells the same story from another angle. Wallet compromise was the single most expensive attack type in H1 2025, accounting for $1.706 billion across just 34 incidents. When so few events produce that much loss, the lesson lands hard for anyone who treats self-custody as a solved problem. Keys became the target precisely because the contracts got harder to break.
The CFTC's 2024 DeFi work named the deeper issue directly. Even systems described as decentralised retain control points, through developers, governance processes, interfaces, admin keys, validators, and bridge operators. The Bank for International Settlements has made a related case for years, describing a decentralisation illusion in which a concentrated layer of human control sits beneath the autonomous surface. Risk follows that control layer, wherever it actually lives.
The DeFi Risk Stack
Evaluation still leans on one or two surface signals, usually annual yield, total value locked, or a green audit badge. Each carries some information, and none describes the full exposure of a position. A better approach treats DeFi risk as layered, because that is how it behaves in practice.
The DeFi Risk Stack separates the exposure into six distinct layers.
• Code risk. Contract bugs, reentrancy, faulty access control, upgrade mistakes.
• Market risk. Thin liquidity, collateral volatility, liquidation cascades.
• Oracle risk. Manipulated or delayed price feeds that drive bad decisions downstream.
• Governance risk. Admin keys, proxy upgrades, concentrated voting power, DAO capture.
• Composability risk. Failure imported from another protocol, a bridge, a wrapped asset, or a shared liquidity venue.
• Recovery risk. Unclear accountability, no guaranteed recourse, weak incident response.
The value of the model is not taxonomy for its own sake. It forces a position to be priced across every layer it actually touches, which is the only way to see that a protocol can score well on code and stay dangerous on oracle, governance, or recovery. An audit speaks to the first layer.
Losses keep coming from the other five.
Composability Turns One Failure Into Many
The ability to plug protocols into one another is DeFi's defining advantage and its most underpriced hazard. Lending markets feed exchanges, yield strategies sit on liquidity pools, and protocols accept each other's tokens as collateral. A single position can depend on several contracts, a bridge, an oracle, a wrapped asset, a stablecoin issuer, and governance votes across separate organisations at once.
None of those parts has to contain malicious code for capital to evaporate. When protocols use each other's synthetic and staked tokens as collateral, one exploit on an underlying asset can set off an automated wave of liquidations across applications that never shared a line of code. Contagion runs at block speed, faster than any human committee can convene.
A second, quieter tax compounds the visible losses. Transparent transaction queues let specialised bots scan pending trades and reorder them for profit, extracting value from ordinary users on the way through. This is the MEV problem, and it sits inside normal protocol mechanics, not any single bug.
Forking widens the blast radius again. New protocols copy established open-source contracts without fully grasping the parameter limits behind them, so a flaw found in one design quietly propagates across the copies. Immunefi's April 2025 figures captured how concentrated this damage gets, with $92,453,100 lost across 15 incidents in a single month where DeFi accounted for the entire reported total. Composability did not cause every one of those losses, but it is what lets a local failure become a shared one.
Governance Is Where an Exploit Becomes an Economic Event
Security conversations tend to start with attackers and end with ownership. Most serious protocols deliberately keep some administrative power. Contracts can be upgraded, treasuries sit behind multisignature wallets, and emergency pauses exist for good reason. Software running billions in assets cannot be frozen fully in place.
The hazard is not that these powers exist. It is who holds them, how they are used, and whether anything stops them becoming the next way in. Admin keys and multisigs are governance tools and attack surfaces in the same moment, which is why private-key and signer compromise now sit among the largest loss drivers in the data.
Weak ownership rarely makes the headline, yet it sets the size of the bill. A decentralised governance process cannot halt a live exploit the way a centralised operator can, because a proposal, a debate window, and an on-chain vote take days while an attacker takes minutes. From there it gets worse. Concentrated token holders can vote down security budgets in favour of fee generation, and insiders holding liquid voting power can sell into public markets before a structural flaw surfaces, capturing the upside and leaving the downside with later depositors.
Recovery is where that weakness turns permanent. CertiK reported that only 0.38% of stolen funds were returned in Q1 2025, down from 42.09% the previous quarter. When the return rate collapses to a rounding error, governance quality stops being a philosophical question about decentralisation and becomes the main thing standing between an incident and a write-off.
Why the Problem Persists
None of this survives because the industry lacks talent. It survives because the incentives reward it. Protocol teams capture fees and token appreciation by deploying fast and pulling in liquidity, while the security cost lands later and lands mostly on depositors.
Speed pays now. Caution pays never.
The payoff maths runs the same way for attackers. A vulnerability worth a modest bug bounty to disclose can be worth orders of magnitude more to exploit, which quietly pushes marginal talent toward the adversarial side. Venture funding tightens the screw, pressing teams toward token launches and deadlines that rarely wait for security to catch up.
Demand reinforces all of it. Capital chases the highest yield regardless of how carefully the underlying code was tested, so protocols that skip rigorous review are often rewarded with inflows, not punished. That pull creates a slow race downward, where thorough risk modelling costs market share.
Investor behaviour closes the loop. A 2025 study from Georgia Tech, drawn from interviews and a survey of nearly 500 crypto investors, found that only 10.8% regularly checked and revoked the token approvals that leave wallets exposed long after a user has moved on. False confidence is not a side effect of the system. It is one of the load-bearing reasons the losses keep recurring.
What Mature DeFi Operations Do Differently
The strongest teams gave up chasing zero vulnerabilities and started designing for the day something breaks. Its clearest marker is the autonomous circuit breaker. Rather than wait for a governance vote mid-exploit, resilient protocols write mathematical invariants straight into runtime, so the system freezes the instant a rule like "withdrawals cannot exceed deposits minus fees" is violated.
Several other practices separate mature operations from the rest.
• Time-locked upgrades that give depositors a window to exit before a contested change takes effect.
• Isolated risk pools that wall off experimental assets so an exploit on a new token cannot drain the blue-chip vault.
• Layered controls combining audits, bug bounties, live monitoring, and rehearsed incident response, not any single safeguard.
• Published control maps that disclose admin keys, signers, pause powers, oracle dependencies, and upgrade rights before anyone deposits.
The economics favour this discipline even though it slows launches. Every undocumented dependency and every unclear line of emergency authority adds delay during the one window when recovery is still possible, and that delay is measured directly in capital that leaves and does not return. A protocol with documented ownership and a tested response plan tends to outlast a better-coded peer with weaker operations.
Where Regulation Is Actually Heading
The common assumption is that regulation will tighten steadily until investors are protected. Evidence points somewhere messier. In April 2025, the United States repealed the IRS DeFi broker rule that would have treated certain non-custodial platforms like brokers for tax reporting, a clear sign that policymakers are not all moving in one direction.
What regulators are converging on is the hunt for control points. IOSCO's DeFi recommendations focus on identifying responsible persons, conflicts, disclosure, and enforcement, on the view that decentralised systems still contain accountable actors. The EU is weighing whether crypto lending and borrowing need dedicated rules under its MiCA Article 142 review. The Financial Stability Board's 2025 work found significant gaps and inconsistencies across jurisdictions, the kind of fragmentation that breeds regulatory-arbitrage risk rather than clean protection.
For an institution, the practical reading is that pressure arrives through the access layer first. Stablecoin issuers, frontends, bridges, custodians, and fiat off-ramps are far easier to reach than neutral protocol code, and that is where screening, disclosure, and reporting duties will concentrate. The FATF reported in 2025 that implementation of virtual-asset standards remains weak across much of the world, which means those gaps persist long enough to matter to anyone holding a multi-year position. DeFi risk, over that horizon, becomes a market-structure and governance-disclosure problem at least as much as a coding one.
The Allocator's Takeaway
Strip the topic back to one line and it holds. An audit tells an investor the code was correct on the day it was reviewed. The DeFi Risk Stack tells them whether the system survives the day something else goes wrong.
That is the shift the data keeps confirming. Losses moved up from contract bugs to signing systems, dependencies, and ownership. Recovery rates fell to a rounding error. Regulators began hunting for who actually controls these systems rather than accepting the decentralised label at face value.
Each trend points at the same place, that exposure lives in the operating model, not in any single contract.
Protocols most likely to last will not be the ones advertising the richest yields. They will be the ones that can show who holds emergency authority, how dependencies are watched, and what happens to user funds when a part of the system fails. Allocators who learn to read those same signals will price DeFi for what it is. Those who keep reading the audit badge as the answer are mispricing it, and the bill for that habit tends to arrive at the worst possible moment.
Frequently Asked Questions
Does a DeFi audit mean the protocol is safe?
No. An audit reviews a defined version of the code under a set scope and timeframe. It does not cover later upgrades, oracle assumptions, bridge integrations, frontends, or governance changes. Treat it as one control inside a wider security posture, not a verdict on the whole position.
Why is governance now treated as a security issue?
Governance decides who can upgrade contracts, move treasury assets, and trigger emergency actions. When those powers are concentrated or poorly documented, ordinary decisions can expose investors to losses unrelated to code quality. With only 0.38% of stolen funds returned in CertiK's Q1 2025 data, the quality of ownership often decides whether an incident is survivable.
What should an institution check before deploying capital?
Beyond the audit, look at who controls upgrades and emergency powers, which oracle sets prices, whether the protocol depends on bridges or wrapped assets, how concentrated voting rights are, and whether a tested incident-response plan exists. These say more about real exposure than yield or total value locked.
Does self-custody remove counterparty risk?
It removes exchange counterparty risk and shifts the burden onto key management, approval hygiene, and phishing resistance. With wallet compromise responsible for $1.706 billion of H1 2025 losses, self-custody changes where the risk sits rather than removing it.
What is the most overlooked risk in DeFi today?
Dependency risk. A position can rely on oracles, bridges, stablecoins, liquidity providers, and frontends that never appear in an audit, and a failure in any one of them can reach investor funds even when the core contracts run exactly as designed.
