Every piece I've published for weeks ends with the same line. Everything runs on @arc testnet. Mainnet, with real funds, comes after a security audit and not before. I meant it. This year's data says that sentence covers the failure mode that is no longer dominant. So, me saying it before someone else does. DeFi has lost at least $1.3bn in the first eight months of 2026, on figures attributed to Forbes and CertiK. Composition matters more than the total: for the first time on record, compromised private keys overtook smart contract bugs as the leading attack vector. The industry spent a decade making its code auditable. It worked well enough that attackers moved. Three incidents, one shape. Drift, $285m on 1 April. Not a protocol flaw. Months of social engineering to reach an admin key, then a drain executed in 128 seconds. Sit with those durations together. Months against people, two minutes against machines. Everything that mattered happened before a transaction was signed. KelpDAO, $290m seventeen days later, a single compromised verifier on its bridge. One credential, in a set designed so no single member could act alone. Third one isn't a protocol. Trezor was not hacked. Not the wallets, not the firmware, no seed or private key exposed. Its shipping provider ShipMonk was breached via a maximum-severity zero-day SQL injection in Metabase, the analytics tool it ran. August: ~13,689 customers. Then 4 September: ~67,000 more US customers, from an earlier ShipMonk engagement running Nov 2019 to Aug 2021, understood to have been deleted. Names, emails, phones, shipping addresses. For a hardware wallet customer base that's a targeting list, not a nuisance. All three, the cryptography held. What failed was a person with a credential, a vendor's dashboard, and a retention policy nobody verified. None of that is what a code audit looks at. Not a criticism of auditors. It's the boundary of the engagement. So the sentence changes. Before real funds move: independent code audit, described signing perimeter, inventoried vendor and data perimeter. The audit is one of three. No date, deliberately. A published date creates pressure, and pressure is how the third one gets skipped. The same shape shows up somewhere that isn't a code audit at all. Reserve attestation is the standard control behind a stablecoin: an accounting firm examines the reserve and publishes, monthly. Real control, binds when performed. In between, anyone deciding whether to accept the instrument is reading a figure that can be weeks old, in a market that never closes. @circle 's cirBTC wrapped bitcoin ships differently. Reserve data published onchain through Chainlink Proof of Reserve, reserve addresses disclosed so you can inspect the holdings on Bitcoin yourself and compare them against supply, reserves not lent or pledged or rehypothecated, and the BTC custodied by an OCC-chartered national trust bank. Attestation isn't worthless. But a periodic control and a continuous one answer different questions, and only one can be asked at the moment you need the answer. Full post in the comment 👇 #Security #DeFi #RiskManagement #cirBTC