CASE FILE — Jul 31, 2026

Drift and KelpDAO Incidents Reveal Limits of Code Audits in Crypto Security

YT By Yuki Tanaka Jul 31, 2026 9 min read

"A protocol can pass a flawless code audit and still lose millions because of a compromised admin key." - Ronghui Gu, CertiK

On April 1st, it took just over two minutes for $285 million to be siphoned from Drift Protocol, Solana’s main perpetuals platform. (Reference)

Rather than an exploit in smart contract logic, the incident centered on Drift Protocol’s administrative controls. Attackers gained access to privileged key management, enabling them to initiate an outward transfer that, from the network’s perspective, appeared legitimate.

Seventeen days later, KelpDAO suffered a separate breach on another blockchain, losing $290 million via a different vector. (Reference) Despite the technical differences, the result was identical: assets exited the system as if via approved actions.

These were among 2026's largest crypto thefts. Both protocols had been audited with no critical findings.

This raises the question: were these audits protecting the actual codebase, or just reinforcing the notion that the codebase is the only point of vulnerability?

Sources: Forbes, CredShields, Chainalysis, Neodyme, Elliptic, LayerZero, decrypt, KelpDAO, The Defiant, samczsun, TRM Labs, Immunefi, Blockaid, CertiK, SlowMist, QuillAudits, ack3, US Department of Treasury, Forbes, Groundhog Day

Drift and KelpDAO weren’t simply the two highest-profile losses of the year; they highlighted a fundamental question: if risks exist outside code, who is responsible for addressing them?

The two project teams reached different conclusions in the aftermath.

For Drift Protocol, the attack was not rushed. Investigations suggest that the operation began as early as fall 2025 at a conference, when individuals posing as a quant trading firm expressed interest in collaborating. (Reference)

Over subsequent months, contributors crossed paths with these individuals in multiple cities and countries.

Trust was established in the manner typical for the sector—through extended, face-to-face interactions.

By April, the attackers leveraged this trust. They exploited Solana’s durable nonce feature to secure a pre-authorized signature from Drift’s Security Council, a permission that should have required more robust verification. (Reference)

With this access, the attackers whitelisted a valueless token (CVT), deposited 500 million units as collateral, and extracted $285 million in USDC, SOL, and ETH. (Reference)

A 2024 audit by Neodyme had previously noted that certain admin instructions—such as InitializeSpotMarket—could accept an oracle account with no validation, but categorized it as an informational issue, assuming only trusted parties could invoke it. (Reference)

Almost two years later, that exact vector was exploited. Once the attackers had the admin key, they established a new collateral market for CVT, pointing to an oracle under their control, prepared weeks in advance.

The audit had flagged the precise mechanism but relied on the assumption that admin credentials would remain secure.

During the same 128-second attack window, the perpetrators also increased withdrawal caps to 500 trillion across five markets using an admin-only update, a function not specifically called out in the audit report. (Reference)

Subsequent analysis connected the Drift event, with medium-high confidence, to UNC4736 (TraderTraitor), a North Korea-linked group also responsible for the Radiant Capital hack in 2024. (Reference)

KelpDAO’s compromise, which occurred 17 days later, was markedly different. There was no elaborate social engineering campaign or in-person interaction. (Reference)

On March 6, a LayerZero Labs developer was socially engineered, resulting in stolen session keys. These were used to compromise the RPC infrastructure supporting LayerZero’s verifier network. (Reference)

After external nodes were rendered inactive by DDoS, only compromised verifiers remained operational. When a forged cross-chain message required a signature, the compromised verifier supplied it. (Reference)

This enabled the unauthorized minting of 116,500 unbacked rsETH, valued at $290 million. (Reference)

Joint reports from Mandiant, CrowdStrike, and LayerZero attributed this attack to the same TraderTraitor group also linked to the Ronin Bridge and WazirX hacks. (Reference)

Despite targeting different blockchains and using distinct methods, both attacks shared a common result: systems operated as designed, yet assets were stolen.

CredShields summarized this shift: the attack surface has evolved to target governance, key signers, and protocol developers, rather than solely code. (Reference)

Although code audits confirmed the technical soundness, they did not evaluate who could authorize critical actions.

If both audits were thorough, but the losses still occurred, where does ultimate responsibility lie?

Assessing Responsibility

LayerZero issued its post-mortem first, casting blame on KelpDAO for not implementing a multi-verifier setup and relying exclusively on LayerZero Labs’ own DVN as the single validator safeguarding a bridge worth hundreds of millions. (Reference)

KelpDAO rejected this narrative, providing data that showed 47% of all LayerZero OApp contracts (over 1,200 contracts) used the same single-verifier configuration. (Reference)

Screenshots shared by KelpDAO documented eight integration conversations spanning two and a half years, during which LayerZero staff reviewed and did not object to the configuration.

KelpDAO asserted: "LayerZero blamed their users for an issue that was caused by their own infrastructure failure." (Reference)

LayerZero’s co-founder, Bryan Pellegrino, soon responded, citing on-chain data and claiming that KelpDAO had originally used LayerZero’s default (MultiDVN or DeadDVN) but later switched to a 1/1 setup. (Reference)

This perspective, however, came from the infrastructure provider under scrutiny.

Three days later, LayerZero reversed its stance, conceding: “We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions… We didn’t police what our DVN was securing, which created a risk we simply didn’t see. We own that.” (Reference)

Despite these admissions, the technical debate remained unresolved.

LayerZero’s forensic analysis, compiled in partnership with Mandiant, CrowdStrike, and zeroShadow, revealed that the rsETH bridge had been downgraded from a 2-of-2 to a 1-of-1 configuration before the breach. (Reference)

The report emphasized that the single-verifier setup enabled the incident and pledged that LayerZero’s DVN would no longer act as sole attestor for any channel.

Following the exploit, the Arbitrum Security Council froze 30,766 ETH (approximately $71 million) associated with the stolen assets, an action enabled by law enforcement’s identification. (Reference)

samczsun, founder of SEAL, described this as a significant milestone for hack victims and expressed hope that it would mark a turning point for industry accountability and user protection.

Sums referenced in this case file

However, this was an exception; in most cases, stolen funds are moved before authorities can intervene or consensus is reached on responsibility.

Despite multiple audits and post-mortems, the essential question—who oversees non-code vulnerabilities—remains unanswered.

Evolving Risks and Ambiguous Metrics

Request data from several security firms about the first half of 2026, and the reported figures vary widely.

This discrepancy arises not from errors, but from differing definitions: some firms count only on-chain exploits, others include rug pulls or limit their focus to DeFi incidents.

The following statistics illustrate the spread:

Across these sources, incident counts range from 87 to 344, with losses spanning $935.3 million to $1.315 billion. The average points to about 206 incidents and slightly over $1 billion lost for the half-year.

One consistent observation: TRM Labs notes that the number of incidents reached an all-time high for any six-month period. (Reference)

Total losses appear lower than in 2025, largely because 2025 included the Bybit hack, a single event costing $1.5 billion. CertiK notes that without Bybit, 2026 actually saw a 28% increase in losses. (Reference)

The median hack was valued at $219,000, while the average (mean) was $4.7 million, highlighting the gap between frequent minor incidents and rare, massive breaches. (Reference)

This disparity reflects an industry characterized by both numerous smaller attacks and a few major events that disproportionately impact totals.

Focusing specifically on DeFi, ack3’s incident ledger—designed to track audit coverage—found 135 verified incidents totaling $939.86 million in H1 2026. (Reference)

Of these, 68 involved an audited party, 46 were entirely out of audit scope, and 20 were cases where an audit should have detected the vulnerability but did not.

The ledger also highlighted supply-chain attacks at varying scales:

Holdstation lost $462,000 due to a stolen developer session token, which enabled code injection into an app update.
Resolv Labs suffered a $24.5 million loss after a signing key compromise tied to a software supply-chain breach.
Polymarket’s front end lost $3.1 million after a third-party vendor’s script was compromised.

All were facilitated by factors outside of smart contract code.

Even the definition of "audited" is subject to debate, as is what qualifies as a hack.

Despite the best efforts of those tracking incidents, the landscape remains challenging to define, let alone predict.

Attacks Without Exploiting Code

The most successful attacks often bypassed smart contracts entirely.

Instead, attackers targeted protocol contributors, trusted vendors, and insecure key management.

Operational security lapses, supply-chain vulnerabilities, and basic identity fraud presented easier opportunities than technical exploits.

North Korea exemplifies this trend, representing a concentrated and persistent threat.

Regardless of which source is consulted, North Korea-linked actors accounted for most crypto losses in the first half of 2026. TRM Labs estimates this at around 66% ($643 million), while Blockaid attributes 55% ($609 million) to a single DPRK cluster. (TRM, Blockaid)

In addition to hacks, TRM Labs identified North Korean involvement in IT worker infiltration, phishing, and fraud that bypassed smart contract vulnerabilities entirely.

In March, the US Treasury sanctioned six people and two entities involved in such schemes, where operatives obtained positions at crypto and tech firms using stolen identities—laundering an estimated $800 million in 2024. (Reference)

This follows a pattern seen prior to the Drift incident, where patient social engineering and fabricated identities replaced direct technical exploits.

Ido Sofer, CEO and co-founder of Sodot, stated on the On The Margin podcast: "There will be hacks. The question is, is it going to be in your company or not. North Korea, they spend a significant amount of resources, and they're going to be successful one way or another. If a nation state is after you, it's going to be very hard." (Reference)

Sofer emphasized that raising the cost for attackers is the realistic path forward:

"You think about attackers. They're organizations," Sofer said. "They calculate the ROI. If you put enough constraints and enough security rails, the cost is going to be higher than my neighbor and the other company, so probably they're going to go there because the ROI is lower." (Reference)

These intrusions require time and social engineering, not exploits in code.

The vulnerabilities exploited in these cases were not technical flaws, but rather weaknesses in process and trust.

It has become rare for major exploits to fall within audit scope, meaning the most impactful events require revisiting audit conclusions and assumptions.

When attackers do not rely on code exploits, what exactly is a security audit protecting?

The underlying system functioned as intended, yet the assets were still removed.

The pattern has persisted from 2025 through 2026: operational failures repeating with little change.

It’s reminiscent of the cycle portrayed in the film Groundhog Day.

Drift and KelpDAO passed their code and integration audits, yet together lost $577 million to attacks that exploited non-code weaknesses. LayerZero and KelpDAO disagreed about prevention responsibilities.

Even among security firms, consensus was lacking on the scale of damages.

While the numbers vary due to methodological differences, the core message is clear.

TRM Labs identified two distinct threat patterns.

Ronghui Gu, CertiK’s co-founder, described it as the defining shape of losses.

In summary: The volume and severity of attacks are increasing, with major losses stemming from incidents outside the contract layer.

A persistent adversary profited regardless of industry debate, leveraging patience and relationship-building instead of technical exploits.

Audits mitigate code risks but do not address issues with key management, signers, or the trust structures around code—areas where substantial losses have occurred.

Proposals like multi-party computation, multi-verifier bridges, and withdrawal delays offer some protection.

However, no technical safeguard can fully address the risks posed by long-term social engineering and trust exploitation.

When technical controls are in place but the attacker walks out with the assets by manipulating human trust, what was actually secured?

Attack SurfaceAuditsOpsec