How to check whether a DeFi protocol is safe

Money is taken through the people who change the program

Most of the money lost in DeFi leaves through people who have the right to change the program: their keys get stolen, or they are tricked into signing. At Drift, the program was changed by a "safe", a multisig (a wallet that needs several signatures), where signatures from two of its five owners were enough for a change.

For weeks, the thief tricked them into signing with fake requests, and on April 1 he became the admin. There was no delay. The rights passed to him at once. He added a worthless coin as collateral, with a price he set himself, and withdrew the money in about 12 minutes. The analysis of the hack by the firm BlockSec of April 3, 2026 says that there was no vulnerability in the code.

According to the quarterly report by the DefiLlama service, more than 80% of what was stolen in the second quarter of 2026 came from two cases: Drift and the Kelp protocol.

That is why you should look for a delay (timelock) first: while an announced change waits in plain sight, you can still take your money out.

An audit checks the code on a date, not the people who will change it

"Passed an audit" means that an outside firm checked the program on a certain date. The audit firm Neodyme, in its May 2024 report on Drift, found one critical issue, and it was fixed.

The auditor also noted that the admin can connect any price source for a coin without a check. This was not considered dangerous, since only the admin can do it. In 2026 the thief became the admin himself and, according to a July analysis by Rekt, got in exactly there.

After a hack, little comes back, and late

Drift gave victims recovery tokens, one for each dollar lost. According to Drift's announcement of October 1, 2026, they are bought back by a fund that holds about 3.1 million USDT for almost 300 million tokens.

If you sell now, you will get about 10 USDT for every thousand lost. The fund grows from revenue, but whoever sells the tokens will not get future payouts. Large sums promised by Tether and partners still have no date.

Russia's law on digital currencies (Law No. 282-FZ, in force since September 1, 2026) does not name protocols. A digital depository (a firm that keeps clients' crypto) is liable for losses from unlawful disposal of a client's crypto, but if third parties caused them, the contract may limit this. From September 2027, a depository or a crypto exchange service that broke the mandatory checks must repay the value of what was stolen within 30 days after the client comes with an official decision to open a criminal case.

How to check a protocol in three steps

Take the website address from the protocol's page on DefiLlama, not from search or chats. On the website, use Ctrl+F to search for the words timelock, multisig and audit. If your money is already inside, go through the steps today.

1. Who changes the program, and with what delay. Look at the Security or Governance section. At Aave, for example, changes are approved by a vote of token holders and wait 1 or 7 days. Stop if this is not written or if a change takes effect at once.
2. Whether the protocol has been hacked. On defillama.com/hacks, type the name into the "Search projects…" field, and find the report on the case by name and date. If it is not in the database or the losses were covered, the step is passed. If the money was not returned or you found nothing about a return, the answer is "don't know".
3. Whether the audit checked where you put your money: loans or the exchange. In Security, find the date of the latest report. If it is more than two years old, the answer is "don't know". Stop if the most dangerous issues, Critical and High, have no Fixed or Resolved mark. If there is no table or it is unclear what the report covers, that is also "don't know".

Had you checked Drift in March, the three steps would most likely have given "passed". Drift covered its 2022 failure with a payout, the auditor's critical issue was fixed, and in March there was a delay. On March 27, according to an analysis by TRM Labs, the delay was removed. The analysts found no announcement of this; the change was visible on the blockchain. Five days later the money was gone.

If even one step gives "stop" or "don't know", do not transfer money, because that is depositing blind. Take out what you have already put in.

All three steps passed? Then the risk is known, but the deposit has not become safe: the program can still be changed later, and the money can be lost almost entirely. We would put in only an amount you can afford to lose.

Frequently asked questions