Four protocols drained this week, combined ~$100M+ loss. All had passed audits.
$CORE b14g protocol: $97M stolen. Zero-amount withdrawal bug treated as full withdrawal. Code sat live 17 months undetected.
Troves: 8.57 $WBTC gone. Team upgraded rebalancer contract but failed to revoke old contract permissions. Basic access control failure.
Kyan: $450K loss. Vault verification checked factory origin but not pool liquidity. Attacker exploited empty pool.
zkLink: $780K drained. Attacker forged merkle root for batch withdrawal and self-validated proofs. Bridge logic completely compromised.
Risk takeaway: Audit stamps mean nothing. Code sits in production with critical flaws for months. Even basic permission management fails at scale. If you're holding tokens on newer DeFi protocols, you're underwriting developer competence risk with asymmetric downside.
$CORE b14g protocol: $97M stolen. Zero-amount withdrawal bug treated as full withdrawal. Code sat live 17 months undetected.
Troves: 8.57 $WBTC gone. Team upgraded rebalancer contract but failed to revoke old contract permissions. Basic access control failure.
Kyan: $450K loss. Vault verification checked factory origin but not pool liquidity. Attacker exploited empty pool.
zkLink: $780K drained. Attacker forged merkle root for batch withdrawal and self-validated proofs. Bridge logic completely compromised.
Risk takeaway: Audit stamps mean nothing. Code sits in production with critical flaws for months. Even basic permission management fails at scale. If you're holding tokens on newer DeFi protocols, you're underwriting developer competence risk with asymmetric downside.