Why Smart Contract Audits Aren’t Stopping Web3 Hacks

The Web3 space has moved on from the "test in prod" mindset, with audits becoming standard practice for projects. However, Web3 hacks are still commonplace, and recent hacks come in as some of the most expensive incidents in history.

Smart contract audits are an essential component of a Web3 security strategy. However, they're not enough on their own, and they have to be done properly to be effective.

The Problem is Getting Worse

Smart contract audits are standard practice, yet 2025 saw about $905 million in losses due to smart contract vulnerabilities across 122 incidents. Improved security processes and tools should reduce attack volumes and loss numbers.

However, smart contracts are ideal targets for attackers leveraging AI-powered code review. Research performed in 2025 using Anthropic's SCONE-bench to examine 405 real-world exploited smart contracts found that over half of the attacks performed in 2025 could have been performed completely by autonomous AI agents.

Many smart contracts are open-source, with code publicly hosted on GitHub. Attackers are increasingly targeting and scanning legacy contracts, with costs of about $1.22 per contract. The payoff of these scans is potentially immense, with several Web3 hacks per month topping $1 million.

Why Smart Contract Audits Aren't Enough

Smart contract audits are generally designed to catch a certain type of threat. Auditors look for known vulnerabilities in smart contract code, often via a combination of automated tools and human review.

While these audits are important and necessary, they don't cover the full range of threats to Web3 projects. Some of the top reasons for this include:

• Audit Scope and Deadlines: Smart contract audits often target a portion of the overall codebase, with other functionality being out of scope. Additionally, they are performed within a certain engagement window, limiting what they can see. This combination means that exploitable vulnerabilities could be out of scope or missed due to time pressure.
• Code Drift After the Audit: Audit reports commonly include hashes of the reviewed version of the code, and updates made after this version aren't reviewed. Often, a "quick fix" or update made after the audit can introduce issues that are deployed on-chain without review.
• Business Logic Flaws: Smart contract audits are often designed to check whether a smart contract contains known vulnerability patterns, such as reentrancy or access control flaws. What they don't always do is verify that what the code does is actually what it was intended to do or that the underlying design is secure. According to OWASP, business logic errors are the second-largest loss category after access control flaws.
• Off-Chain Risks and Threats: The scope of smart contract audits is limited to the smart contract code. This misses off-chain infrastructure, private key security, supply chain vulnerabilities, and other off-chain threats. The $1.5 billion Bybit hack, the largest Web3 hack in history, involved the compromise of the signing interface used to secure a multi-sig wallet.

Closing the Web3 Security Gap

Smart contract audits aren't enough because they have limited scope and time windows. When attackers target vulnerabilities outside the audit scope or that are introduced post-audit, the report provides a false sense of security. A comprehensive Web3 security program incorporates continuous security review and auditing and addresses potential weaknesses that fall outside the smart contract code.