Your audit certified the code. The attacker is signing in as you.
Four incidents, four different mechanisms, and not one of them was a Solidity bug the auditors were asked to look for.
A code audit certifies the code as written. It does not certify the humans who hold the keys, the domain your users type, the endpoint your frontend reads, the oracle your contract trusts, or the approval a contributor granted eighteen months ago and never revoked. Those are not gaps in the audit. They are outside its scope by definition, and they are where the losses now are.
Four mechanisms, none of them the contract
A workstation. At Bybit, a compromised developer machine served tampered JavaScript to a signing interface. The council approved what the screen showed them while their hardware devices received something else. Every contract behaved correctly and $1.46B left in one approved transaction.
A permission nobody revoked. At Ronin, an allowlist granted five months earlier let one organisation sign on behalf of another validator, which was enough to reach a five-of-nine threshold on its own. Two withdrawals took $624M, and the loss surfaced six days later when a user could not withdraw.
A configuration published in advance. Harmony's Horizon bridge moved funds on any two of five keys. That threshold was on chain and readable by anyone before roughly $100M left across fourteen transactions. It was not a forensic finding. It was a structural fact about how the asset was built.
A supply chain. The Ledger Connect Kit compromise put a wallet drainer inside hundreds of legitimate decentralised application front-ends for about five hours. Every dApp was real, every domain was correct, every hardware wallet worked as designed, and every user who lost funds approved the transaction themselves.
What watching the operational surface actually means
It means a per-signer behavioural baseline, so a compromised signer breaks a pattern even when the signature is valid. It means simulating what a governance payload executes on forked state rather than reading what its title claims, which is the exact gap the Bybit council fell through. It means watching DNS records and served JavaScript for the frontend your users actually load. And it means treating an unlimited approval to a fresh spender as worth waking someone for, because it is often the first act of a drain that completes weeks later.
None of this requires a contract change, an SDK or a key. It requires somebody looking at the surface the auditors were never asked about.
More from the walls.
Post-block alerting is a receipt, not a defence
It tells you precisely how much you lost and exactly when you lost it. Both facts arrive too late to be worth anything.
6 min read
Why the model is never the first line of defence
Software that guesses does not get to declare an emergency. The layer order is a commitment, not a preference.
5 min read
Read and attest: capping the blast radius of your own vendor
The question nobody asks their monitoring vendor: what happens on the day the vendor is the one that gets breached?
6 min read
The next breach is already being dug.
Every engagement is scoped to your protocol by the team, and pricing follows that scope.