# DeFi Security Illusion Source: https://x.com/Eli5defi/status/2043690690069004323 Kiwi News: https://news.kiwistand.com/stories/DeFi-Security-Illusion?index=0x69de290c8c8cdf0aa3165c1b4a932ed2740b0492e34737e2357f66457b6d655be7759f12 Submitted by rvolz.eth on 2026-04-14 UTC, 2 upvotes, 0 comments ## Summary The article argues that most DeFi security relies on friction-based defenses such as multisigs, timelocks and audits, which do not stop the human and infrastructure attacks behind most losses, and that AI is making this gap worse. It cites $3.4 billion stolen in 2025, with access control failures accounting for 59% of that. Drift Protocol lost $285M in April 2026 after a six-month infiltration compromised two of five Security Council signers, and 31 transactions drained the protocol in about 12 minutes. The author concludes that hard-barrier approaches such as formal verification, ZK-based access control and hardware enclaves, combined with friction, are the direction the data supports. ## Article Do you know how much has been lost in DeFi due to hack and exploit? $3.4 billion stolen in 2025. Access control failures alone account for 59% of that. Not smart contract bugs. Not reentrancy exploits. People. Keys. Trust. Most DeFi protocols today believe they are secured. They have a multisig. They have a timelock. They have two audit reports from reputable firms. They have a bug bounty. The post-mortems keep proving otherwise. Anthropic's Frontier Red Team put it plainly in their April 2026 assessment of Claude Mythos Preview: Mitigations whose security value comes primarily from friction rather than hard barriers may become considerably weaker against model-assisted adversaries. That sentence was written about operating systems and kernel exploits. Unfortunately, it applies to DeFi apps with equal force. Two Categories of Defense There is a clean way to split DeFi security mechanisms. Friction-based defenses slow attackers down. They impose time costs, coordination costs, visibility costs. They assume the attacker will tire, get caught, or move on. Multisigs require compromising multiple parties. Timelocks create a window for the community to notice. Audits flag obvious vulnerabilities before deployment. Hard-barrier defenses make attacks mathematically impossible, not just costly. They don't assume anything about attacker patience. Formal verification proves that a contract cannot enter an invalid state, for all possible inputs, not just the ones a developer thought to test. Zero-knowledge proofs let a signer prove they have the right to authorize an action without revealing any information an attacker could capture and replay. Hardware enclaves execute code in a physically isolated environment where even the server operator cannot inspect the computation. The distinction matters because the threat model has changed. In 2022, most attacks were opportunistic: find a bug in a smart contract, write an exploit, drain the funds before anyone notices. Friction worked reasonably well against that. It doesn't work against a state-sponsored team running a six-month infiltration operation. It doesn't work against an AI agent that will grind through social engineering steps at machine speed. Why Friction Fails: The Pattern Across Major Exploits Six of the largest DeFi losses share a structure. None involved breaking cryptography. All involved human manipulation, supply chain compromise, or interface deception. Bybit — $1.5B, February 2025. Three signers. Safe{Wallet} cold storage. Lazarus Group compromised a developer machine at Safe{Wallet}'s infrastructure vendor, injecting malicious JavaScript into an AWS S3 bucket. The Safe UI showed legitimate transaction data. The payload executing underneath was a complete fund drain. The signers never knew. Keys were never stolen, the trust layer was. Ronin Bridge — $625M, March 2022. Five-of-nine validator structure. A fake LinkedIn job offer delivered a malware PDF to a Sky Mavis engineer. Four of nine keys were compromised through a single developer. A fifth key came from never-revoked stale permissions the Axie DAO had issued months earlier. The theft ran undetected for six days. Nomad Bridge — $190M, August 2022. No social engineering required here — Nomad's own upgrade introduced it. A routine migration initialized a root hash to 0x00, which the system auto-trusted. Any arbitrary message became valid. No circuit breaker existed. Within four hours, 300 separate addresses had copied the exploit transaction and drained the bridge. The audit was real. The auditors looked at the right code. The bug was introduced after. BadgerDAO — $120M, December 2021. The smart contracts were fine. An attacker compromised a Cloudflare API key, injected malicious JavaScript into the Badger frontend, and tricked users into approving unlimited token spend. The scripts ran undetected for three weeks. Every audit Badger had was irrelevant. The attack was Web2. Radiant Capital — $50M, October 2024. North Korean operatives posed as a former contractor over Telegram, delivered a macOS backdoor disguised as a PDF, and compromised multiple developer devices. They then manipulated the Safe{Wallet} frontend to display legitimate transaction data while executing malicious calls against a 3-of-11 multisig. Ledger hardware wallets could not parse the Gnosis Safe transaction format, forcing signers into blind signing. Drift Protocol — $285M, April 2026. The same DPRK group responsible for Radiant ran a six-month infiltration of Drift's contributor network, attending conferences, depositing capital into ecosystem vaults, building genuine working relationships. Two of five Security Council signers were compromised through malware embedded in a shared code repository. Pre-signed durable nonce transactions executed on April 1: a fabricated token was listed as collateral, withdrawal limits were raised, and 31 transactions drained the protocol in approximately 12 minutes. Drift had migrated its Security Council to a 2-of-5 threshold with zero timelock one week earlier, eliminating the detection window the old structure would have provided. The common thread: friction stopped nothing. The attackers were patient, funded, and focused on the human and infrastructure layers that friction-based defenses don't cover. Smart contract bugs as a share of losses: 8% in H1 2025. Access control and key compromise: 59%. How AI Shifts the Equation Friction works on a resource constraint. It assumes attackers have limited time, limited capital, limited ability to maintain sustained operations. AI removes those constraints in ways that matter for DeFi specifically Social engineering at scale. Google Mandiant documented in February 2026 that DPRK-affiliated group UNC1069 deployed AI-generated deepfake video of a real cryptocurrency CEO during a live Zoom call, combining it with seven distinct malware families in a single attack chain. The SoSafe 2025 survey found AI-generated phishing emails achieve 54% click-through rates. The humans in the loop, the multisig signers, the core contributors, the community moderators, are increasingly the most reliable attack surface. Vulnerability discovery speed. SANS Institute's Chief AI Officer Rob Lee put the timeline compression directly: what once required thousands of personnel on a nation-state team now runs with two individuals. Academic research on AI-assisted smart contract auditing shows current LLM frameworks detecting vulnerabilities at $1 per contract vs. $15,000+ for human audits, with recall rates exceeding traditional automated tools. The agentic exploit-generation research (A1 Framework, PoCo, LLM-SmartAudit) demonstrates that AI can move from vulnerability discovery to executable proof-of-concept without human intervention. The friction grind. Anthropic's own assessment of Mythos Preview is the clearest statement of where this is heading. The model found thousands of zero-day vulnerabilities across every major OS and web browser, including a 27-year-old OpenBSD bug and a 16-year-old FFmpeg vulnerability that automated tools had missed across five million test runs. The assessment explicitly noted that AI models operating at scale "grind through tedious steps quickly, making friction-based mitigations structurally weaker. Techniques that impose hard barriers, immutable properties, cryptographic guarantees remain effective. What Hard Barriers Actually Look Like The tooling exists. It is underused, especially relative to TVL at risk. These are some list but not exhaustive and we will see them more of these technologies developed in the future. Formal verification. @Certora 's Prover operates by having developers specify invariants, mathematical properties the system must maintain, and then exhaustively proving those properties hold for all possible inputs. In 2025, Certora's work covered $196.5 billion in TVL, prevented 720+ vulnerabilities, and identified 80 critical and 180 high-severity issues, 99% of which were fixed before deployment. Aave's team documented that FV caught a repayment vulnerability in Aave V3 that multiple auditors had missed. MakerDAO's implementation surfaced a fundamental equation bug in the DAI mechanism that had existed undetected since 2018, with $10 billion at risk. a16z's Halmos brings symbolic testing to Foundry test suites, catching vulnerabilities on existing codebases without requiring new specification work. The honest limitation: formal verification ONLY proves the properties you specify. Oracle manipulation, governance takeovers, off-chain infrastructure failures, and private key compromise are outside the scope of contract-level proofs. ZK-based access control Zero-knowledge proofs let a party prove membership, identity, or authorization without revealing the underlying credentials. An attacker who compromises one signer's device captures keys. An attacker who compromises one signer's device in a ZK-gated system captures nothing the cryptographic proof doesn't already make public. Production deployments are mostly at the identity layer. Hardware enclaves TEEs (Intel SGX, AMD SEV) execute code in physically isolated environments where even the server operator cannot inspect the computation. Secret Network runs SGX on every validator. The honest bear case: SGX has a documented vulnerability record. The sgx.fail research catalog includes complete compromises via side-channel and hardware attacks at cost. Best practice in 2026 treats TEEs as one defense-in-depth layer requiring hybrid architecture with ZK or MPC, not a sole trust anchor. The Framework Worth Building Toward Trail of Bits published a maturity model in June 2025 that maps the friction-to-hard-barrier spectrum directly: Level 1 — Single EOA. No meaningful security. Level 2 — Centralized multisig. Friction only. "All-or-nothing security." Level 3 — Timelocks with role separation. Friction with detection windows. Where most major protocols sit. Level 4 — Radical immutability. Minimizing private key use through purpose-built contracts, immutable parameters, rate limiters enforced at the contract level, and user-level exit rights that cannot be suspended by any key. Most protocols sit at Level 2 or 3. The exploits are concentrated there too. The honest verdict: no single mechanism closes all attack surfaces. The combination that makes protocols materially harder to compromise is formal verification of critical code paths + immutable contract parameters where operationally feasible + ZK-based identity for signer verification + rate-limited, monitored timelocks as complementary friction + reactive infrastructure (SEAL 911 emergency response, circuit breakers with real monitoring). The weakest link today is consistently the human one. Building toward architectures that minimize trust in human decision-making at the point of execution is the direction the data supports. Audits remain necessary. Multisigs remain necessary. Neither is sufficient when the attacker has six months, an AI-assisted social engineering toolkit, and state-level patience. NFA.DYOR Check My Other Channels: Substack → https://eli5defi.substack.com Telegram → https://t.me/eli5definews Disclaimer: This information is for educational purposes only and does not constitute professional financial or tax advice. Some content may be developed in collaboration with third parties, and we may hold positions in the assets mentioned. We strongly recommend conducting independent research and consulting with a qualified professional before making any financial or tax-related decisions.