# Losses Move to Components That Worked as Designed

A growing share of DeFi losses will come not from buggy contract code but from components behaving exactly as specified — oracle forwarders, validator signature sets, governance votes and other trusted off-contract inputs — so audits and bug bounties scoped to on-chain code keep missing the failure surface, and protocols will be repeatedly forced to extend review, scope and monitoring to their privileged operational infrastructure.

- Conviction: 100 / 100 (strengthening)
- 7-day move: 0
- Horizon: Medium term (3-9 months)
- Tracking since: 2026-08-10T00:00:00.000Z
- Last updated: 2026-08-28T06:23:07.647Z
- Canonical: https://polylog.news/crypto/trends/authorized-path-exploits
- Publisher: Polylog
- Affected regions: Global

## Recent score history

- 2026-08-27: 100
- 2026-08-28: 100

## Recent evidence

- [confirms] Security Roundup: Governance Takeover, Hot-Wallet Drain and 40 Malicious Firefox Extensions (2026-08-27): Term Labs lost $8.5 million to an attacker who simply bought enough voting power to pass a malicious governance action, and Coinsbuy lost $7.9 million to what investigators call key or admin compromise. Both losses ran through privileged paths functioning as specified — a valid vote and valid admin keys — so no contract audit would have flagged them.
- [confirms] Moonwell's cbETH market still shows negative liquidity six months after an oracle misconfiguration (2026-08-26): Moonwell's cbETH market still shows utilization above 100% six months after an oracle misconfiguration, stranding suppliers who were never liquidated, and the latest recovery plan allocates nothing to the roughly $1.8 million gap. The loss came from a correctly functioning price input configured wrongly rather than from contract code, and the six-month unhealed gap shows how poorly protocols are provisioned to remediate this failure surface.

18 more evidence entries, the full score history, the conviction-driver timeline, and affected assets are for subscribers: https://polylog.news/pricing