🤖 AI Summary
This study addresses a critical disconnect between blockchain security audits and real-world attack incidents, which has led to significant defensive blind spots. By systematically analyzing 23,818 audit reports and 218 on-chain attacks from 2022 to 2026, the work reveals a severe misalignment between audit focus and high-impact attack vectors—nearly 50% of financial losses stemmed from social engineering attacks (e.g., private key compromises and phishing), which are rarely covered in audits. Moreover, 71.4% of total losses were concentrated in just the top 20 incidents. Leveraging multi-source data fusion and distribution modeling, this research challenges conventional risk assessment assumptions and exposes systemic biases in current auditing paradigms, particularly in coverage breadth and risk-weighting prioritization.
📝 Abstract
This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.