--- title: "The Auditors Signed Off. The Money Left Anyway." url: https://daily.dev/posts/the-auditors-signed-off-the-money-left-anyway--p8brhmwb5 source_url: https://coinsbench.com/the-auditors-signed-off-the-money-left-anyway-f8171fba9c25 type: article source: "Coins Bench" published: 2026-08-26T10:49:06.720Z updated: 2026-08-26T10:49:37.763Z tags: ["security", "blockchain", "cryptography", "defi"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Auditors Signed Off. The Money Left Anyway. **[Coins Bench](https://daily.dev/sources/coinsbench)** · 11 min read · 0 upvotes · 0 comments ## Summary Data from Blockaid, Global Ledger, and TRM Labs shows that in the first half of 2026, 74% of crypto losses (roughly $1.1B out of 212 verified onchain exploits) came from operational failures rather than smart contract bugs. Case studies include Drift Protocol ($285M via a weeks-long social engineering campaign against admin multisig holders, drained in under 12 minutes), KelpDAO ($292M via a compromised LayerZero developer poisoning RPC infrastructure), and Ostium ($23.75M via a price-submission authority abusing a pull-based oracle with no sanity checks). Both Drift and KelpDAO were linked to Lazarus Group's TraderTraitor cluster, which took ~$609M in the half-year. The piece argues that key-compromise losses almost never get recovered, unlike protocol-bug losses, and proposes five defenses: timelocks on privileged actions, eliminating single points of failure across keys/devices, treating off-chain inputs as hostile with sanity bands, rate-limiting and circuit-breaking outflows, and training team members against social engineering. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Drift Protocol $285 million exploit on Solana actually happen? Attackers ran a weeks-long targeted social engineering campaign against specific Drift Protocol team members with privileged access, eventually gaining administrative multisig control. From there they fabricated collateral pricing data and drained approximately $285 million, the largest exploit in Solana's history, in under twelve minutes from the first malicious transaction. _Teams hardening admin key security against social engineering follow incident breakdowns like this on daily.dev._ ### How did attackers drain $292 million from KelpDAO without breaking any cryptography? Attackers socially engineered a LayerZero developer to gain access, then used it to poison RPC infrastructure feeding false bridge configuration data. A phantom burn on one chain released 116,500 rsETH on another, and the verifier worked correctly but was fed lies; the fake rsETH was then posted as collateral on Aave to borrow real ETH before withdrawal. _Developers designing cross-chain bridge trust assumptions track incidents like this on daily.dev._ ### Why did the Ostium DEX oracle exploit succeed even though the signature check passed correctly? Ostium used a pull-based oracle accepting a signed price at settlement with no independent cross-check on the submitted value. An attacker with price-submission authority opened BTC longs at $5,000 and closed them near $60,000, prices that never traded anywhere, extracting $23.75 million because the contract only verified signer authenticity, not price sanity. _Anyone designing oracle input validation weighs tradeoffs like this by following DeFi security writeups on daily.dev._ ## Similar posts on daily.dev - [AI-powered crypto hacks drain $600M from DeFi as North Korea exploits surge](https://daily.dev/posts/ai-powered-crypto-hacks-drain-600m-from-defi-as-north-korea-exploits-surge-0k39vdlru) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#blockchain](https://daily.dev/tags/blockchain), [#cryptography](https://daily.dev/tags/cryptography), [#defi](https://daily.dev/tags/defi) [View this post on daily.dev](https://daily.dev/posts/the-auditors-signed-off-the-money-left-anyway--p8brhmwb5)