Audits are accomplishing exactly what they are designed to do — discovering errors in the code. And they’re working. Fewer attacks than before take advantage of faulty code to steal platform funds.

The problem, however, is that we’re seeing a growing disconnect between what audits examine and what attackers actually exploit. Today, the industry’s largest losses don’t actually originate from traditional smart contract vulnerabilities. Rather, they come from compromised private keys, governance manipulation, insider compromise, malicious dependency updates and operational failures.

As brilliant as they are at identifying code vulnerabilities, traditional audits cannot prevent a developer from falling victim to a phishing campaign….