Trail of Bits Audited Them. They Got Hacked Anyway.

Black Hat USA 2026 is underway in Las Vegas this week, and both of its keynotes are built around the same idea: offense is getting cheap because of AI, and defense has to change shape or lose the arms race. Trail of Bits, whose name shows up on more crypto security audits than almost any other firm, has used the moment to argue it saw this coming. The company has spent roughly a year rebuilding itself around AI tooling, and says the bet is already showing up in how many bugs its engineers find per week, not just in marketing copy.

That confidence sits next to an uncomfortable fact. In 2025, two protocols that Trail of Bits had personally audited, Balancer and Bunni, were drained for a combined total well past $100 million. Both hacks traced back to the same category of bug: a rounding error in how a smart contract handles very small amounts of value. Balancer had been through 11 audits from four different firms. Bunni had been reviewed by Trail of Bits itself only months before its exploit. Neither history of scrutiny stopped the loss.

This is not really a story about Trail of Bits doing sloppy work. It is a story about what an audit report actually promises, what it does not, and what happens when one of the industry’s most credentialed security firms decides that billing engineers by the week is no longer enough on its own, so it builds an AI-native operation, open-sources a piece of its DARPA prize-winning software, and partners with OpenAI to help patch the rest of the open-source internet along the way. Here is what its reports actually said in the two highest-profile misses, what its wider record shows, and where the firm is placing its next bets.

Who Trail of Bits Actually Is

Trail of Bits was founded in 2012 by Dan Guido, who remains CEO today, alongside fellow security researcher Alex Sotirov, now the firm’s co-CEO. Both had been doing offensive security research since their teens, and the company built its early reputation on browser exploitation and binary analysis, years before crypto existed as an audit market at all. The firm is privately held and has never taken a headline venture round; it funds itself through paid engagements and government research contracts, a lineage that runs back to early DARPA work. It organizes its practice around six areas: application security, cryptography, blockchain, AI and machine learning, low-level systems, and software supply chain.

Its crypto client list reads like a roll call of protocols that make up a large share of DeFi’s total value locked: Uniswap, Compound, Aave, MakerDAO, Chainlink, the Solana Foundation, Arbitrum, ZKsync, and Squads, among many others. It has also branched well outside crypto, having audited Zoom’s end-to-end encryption in the past and, more recently, Perplexity’s agentic browser Comet, covered later in this piece. Leadership beyond Guido and Sotirov includes Artem Dinaburg as chief scientist for research, with engineering directors running the blockchain, cryptography, and machine-learning practices specifically, a structure built for depth in a handful of hard technical domains rather than broad generalist coverage.

The Toolkit Behind the Reports

Trail of Bits gives away most of its tooling for free under the Crytic brand, which has become close to a default for anyone writing Solidity. Slither is a static analyzer that reads a contract without running it and flags common bug patterns in seconds. Echidna is a property-based fuzzer: developers write invariants, statements that should always hold no matter what a contract is fed, and Echidna tries to break them through randomized testing. Medusa is the newer, Go-based successor, built on top of go-ethereum, running coverage-guided parallel fuzzing and using Slither’s own output to steer which code paths get mutated first.

The strategic logic is simple: free tools catch the shallow, mechanical bugs, reentrancy, unchecked external calls, integer truncation, so the paid engineers on an actual engagement can spend their limited hours on design-level flaws that no scanner reliably finds, the kind that come from how a protocol’s economic logic interacts with itself across several contracts at once. In November 2025 the firm extended that logic with slither-mcp, a server that lets an AI coding assistant call Slither directly as a tool instead of a human running it from the command line, folding static analysis straight into whatever agentic workflow a developer already uses.

How to Actually Read a Trail of Bits Report

Most people outside the audit process only ever see a project announce that it was “audited by Trail of Bits,” without reading a word of the underlying document. The firm has published its own guide to that document, Anatomy of a Report, and it is worth understanding the structure before trusting the badge on a landing page.

The cover page carries what the firm calls the single most important number in the entire report: the level of effort, measured in person-weeks. A two-week review of a large, novel protocol is a very different signal than a two-week review of a small, well-trodden one, and that number rarely makes it into a project’s own marketing. The executive summary then plots findings on two axes at once, severity and difficulty, rather than a single score, because “an easy medium can outrank a hard critical.” A codebase maturity evaluation grades the project across six dimensions, documentation, testing, access controls, supply-chain hygiene, error handling, and configuration, on a Weak-to-Strong scale rather than a numeric one. Each finding then gets a full write-up including a concrete attacker walkthrough, and two appendices close the document out: Appendix A ships runnable artifacts, while Appendix B documents the fix review, marking each finding as fixed, still open, or accepted as a known risk.

Balancer: The Bug Flagged in 2021, Exploited in 2025

The clearest test of what an audit report actually promises is Balancer. During an October 2021 engagement, Trail of Bits identified finding TOB-BALANCER-004, a rounding-direction issue in how the protocol’s Linear Pools consumed its Stable Math library. The firm could not confirm at the time whether the behavior was exploitable under real-world pool configurations, so it marked the finding’s severity as undetermined and recommended further fuzz testing to validate rounding direction across edge cases.

Four years later, on November 3, 2025, attackers found the exploitable configuration. The same underlying rounding weakness had resurfaced in Balancer’s related Composable Stable Pools, and the resulting exploit drained more than $100 million across nine separate blockchain networks (Balancer v3, which runs on different code, was unaffected). In its own retrospective, Trail of Bits did not distance itself from the miss. The firm wrote plainly that the blockchain ecosystem’s threat landscape was much different in 2021, and that “the industry at large did not consider rounding and arithmetic issues to be a significant risk.” A precision loss of one wei in the wrong direction, the firm noted, looks trivial when a fuzzer first flags it; in a low-liquidity pool with the right parameters, that same wei becomes profitable to extract at scale.

Balancer v2 was not lightly reviewed. Across its lifetime it was audited 11 separate times by four different firms, OpenZeppelin, Trail of Bits, Certora, and ABDK, according to Cointelegraph’s reporting on the exploit. Suhail Kakar, developer relations lead at TAC Blockchain, put the uncomfortable version of that math on the record: “Balancer went through 10+ audits,” he said. “The vault was audited three separate times by different firms still got hacked for $110M. This space needs to accept that ‘audited by X’ means almost nothing. Code is hard, DeFi is harder.”

OpenZeppelin’s own retrospective adds the sharpest illustration of what audit scope means in practice. Its second Balancer engagement, covering changes to the StablePool and StableMath implementations, ran from August 23 to September 10, 2021. The LinearPool contract was added to the repository on September 1, and the ComposableStablePool contract, the one ultimately exploited, was added on September 20, ten days after that audit had already closed. As the firm put it directly, “new contracts were added to the repository but were not within the scope of our engagement.” An audit does not cover a codebase. It covers a snapshot of one, frozen on the day the engineers stopped reading.

Bunni: Three Firms, One Missed Rounding Direction

Bunni, a decentralized exchange built on Uniswap v4’s hook system, was not under-audited either. According to Bunni’s own documentation, its v2.1 contracts were reviewed by Trail of Bits in January 2025, by Pashov Audit Group that August, and by Cyfrin twice, once in June 2025 and again in July for a fee-override hooklet. None of those engagements caught the specific bug that ended the protocol.

On September 2, 2025, an attacker borrowed roughly 3 million USDT through a flash loan, used it to push a Bunni pool’s price to an extreme, then executed 44 consecutive small withdrawals. Each withdrawal was supposed to round Bunni’s internal idle-balance figure down; under the manipulated price, the rounding direction flipped instead. Forty-four tiny errors compounded into one large one, the pool’s active USDC balance collapsed even though almost no shares had actually been burned, and the attacker reversed the trade for a profit. The final toll, per The Block’s reporting, was $8.4 million pulled from a USDC/USDT pool on Ethereum and a weETH/ETH pool on Unichain.

Bunni initially tried to recover, reopening withdrawals within days while working with the security firm Cyfrin to test a fix for the rest of the protocol’s functions. It did not work out. On October 23, 2025, Bunni announced a permanent shutdown, telling users that securely relaunching would cost six to seven figures in fresh audits and monitoring alone, capital the team no longer had, according to CoinDesk. The team committed to distributing remaining funds to token holders and open-sourcing what was left of the codebase.

What “Audited Yet Hacked” Actually Means

Set side by side, Balancer and Bunni are not quite the same failure. Balancer is a story about severity: Trail of Bits found the exact bug in 2021 and could not prove, at the time, that it was dangerous enough to block a launch over. Bunni is a story about coverage: three different firms reviewed the contracts across seven months, and the specific manipulated-price rounding path that mattered simply was not among the cases any of them happened to test.

Trail of Bits’ own response to the Balancer case is a four-part framework worth taking seriously as a general standard, not just an apology:

• Document every rounding and precision-loss assumption as a formal, provable claim rather than a code comment a future developer can ignore
• Get as close to full unit and integration coverage as realistically possible, and add mutation testing on top of it, since coverage alone does not prove a test suite would catch a change in behavior
• Run continuous fuzzing campaigns with tools like Echidna and Medusa rather than a single pass before launch
• Treat formal verification as an additional layer for the arithmetic paths that carry the most value, not a replacement for the first three

Outside experts have converged on a similarly blunt conclusion. David Schwed, chief operating officer at SVRN and founder of Yeshiva University’s cybersecurity master’s program, told CoinDesk that the real shift the industry needs is “continuous auditing with suggested remediations at a fraction of the cost, instead of a point-in-time review you can only afford once.” Alexander Urbelis, chief information security officer at ENS Labs, put the limit of any static review even more bluntly to the same outlet: “the bugs that drain treasuries often turn on intent and adversarial incentives.” A report frozen on the day it was delivered cannot see either one coming.

What No Audit Report Ever Promises to Catch

Rounding bugs are, in a narrow sense, the good kind of problem, they live in code that a static analyzer or fuzzer can eventually be tuned to catch. A large share of the value lost in crypto every year never touches a smart contract at all. Key management failures, phishing, and social engineering routinely move more money than a clever piece of Solidity ever could. No amount of Slither coverage protects a treasury from a signer approving a transaction they never actually verified, which is exactly why a well-run multisig setup, with hardware signing and independent verification on every device involved, sits outside an audit’s scope entirely and has to be treated as its own discipline. Schwed made the same point to CoinDesk in blunter terms: “no code scanner stops an authorized signer from approving a transaction they can’t verify.”

Cross-chain bridges present a related but distinct blind spot. A bridge audit can confirm that a contract’s code does what its design document claims, but it cannot make the underlying trust assumption, that a validator set, a multisig, or a light client correctly represents the state of another chain, disappear. As HOGE Wire has covered in detail, 2026’s bridge hack wave kept demonstrating that the riskiest part of a bridge is rarely the Solidity itself; it is the assumption sitting underneath it. An audit can verify the logic. It cannot verify the world that logic depends on.

Urbelis’s broader warning to CoinDesk applies here too: as AI-generated audits get cheap and fast, “a clean AI report will be seen as no defense,” precisely because everyone will have one. A badge stops functioning as a signal the moment it stops being scarce.

Trail of Bits Bets the Company on AI

In a March 2026 post adapted from a talk at the [un]prompted AI security conference, Guido laid out how far the firm has pushed this internally. Adoption of AI tooling across the company went from roughly 5 percent to 94 percent in about a year. Engineers now work from a shared library of 94 plugins, 201 skills, and 84 specialized agents. On engagements suited to the approach, the firm says its teams now surface around 200 bugs a week, up from roughly 15 a week before, with about 20 percent of all reported client bugs first surfaced by AI and always verified by a human before reaching a client report. On the business side, the firm claims roughly $8 million in revenue per sales representative, against a consulting-industry benchmark it puts at $2 million to $4 million.

Guido frames the distinction as one between a tool and an operating system: “AI works,” he wrote. “Most companies are using it wrong. They give people tools without changing the system. That’s the gap between AI-assisted and AI-native. One is a tool, the other is an operating system.” The six-part model behind that claim runs like this:

• Standardize on one supported agent workflow instead of letting every engineer pick their own tools
• Set risk-based usage rules in an internal AI handbook
• Measure adoption against a capability ladder with defined progression levels
• Run short, mandatory adoption sprints that force hands-on use
• Package what works into reusable skill libraries the whole firm can draw on
• Only then allow sandboxed autonomy, with guardrails and hardened defaults

The firm used this year’s Black Hat conference in Las Vegas, held from August 1 through 6, to make the same case publicly: both keynotes on the main stage this year are built around AI’s effect on vulnerability research, a theme Trail of Bits has been arguing internally since it restructured around AI roughly a year earlier.

Buttercup and the DARPA Prize

The clearest proof point behind the AI-native pitch predates the March 2026 blog post by half a year. At DEF CON 33 in August 2025, DARPA closed out its two-year AI Cyber Challenge, a competition testing whether AI systems could find and patch vulnerabilities in critical open-source infrastructure without a human in the loop during the run itself. Trail of Bits entered a Cyber Reasoning System called Buttercup, built around AI-augmented fuzzing layered on a libFuzzer backbone, using large language models to write semantically meaningful test cases rather than random byte-flipping.

Buttercup found 28 vulnerabilities across 20 different CWE categories and shipped 19 correct patches at roughly 90 percent accuracy, at an estimated cost of $181 per competition point, notably using non-reasoning models rather than the most expensive frontier systems on the market. It finished second and won $3 million, behind Team Atlanta’s Atlantis system, a hybrid of traditional fuzzers, symbolic execution, and language-specific AI assistants built by engineers from Georgia Tech, KAIST, POSTECH, and Samsung Research, and ahead of Theori in third. Andrew Carney, the AIxCC program manager, said afterward that “since the launch of AIxCC, community members have moved from AI skeptics to advocates and adopters.” He added that “quality patching is a crucial accomplishment that demonstrates the value of combining AI with other cyber defense techniques.” It was, notably, Trail of Bits’ second career trip to a DARPA runner-up podium; the firm also placed second in the 2016 Cyber Grand Challenge, the AI Cyber Challenge’s human-supervised predecessor.

Trail of Bits open-sourced Buttercup immediately after the competition and has kept developing a standalone version that runs on a single laptop, tuned to fit a budget an individual open-source maintainer could actually afford rather than the competition-grade compute the finals allowed. That instinct, security tooling as a public good rather than a one-off government prize, carries directly into the firm’s next project.

Patch the Planet: Auditing the Open Source Internet

On June 22, 2026, Trail of Bits and OpenAI launched what is effectively Buttercup’s successor at internet scale. Patch the Planet, part of OpenAI’s broader Daybreak security initiative, pairs OpenAI’s GPT-5.5-Cyber model and Codex tooling with Trail of Bits engineers who triage every AI-generated finding by hand before it ever reaches a maintainer. The pitch to open-source projects is direct: apply, and if selected, receive a week of dedicated security engineering, tooling improvements, and six months of ChatGPT Pro access, at no cost to maintainer communities that in most cases have no security budget at all.

The human-review step is the part worth underlining, because it is the same lesson Balancer and Bunni taught the hard way: an AI-generated finding is a lead, not a verdict. Trail of Bits engineers reproduce each finding, check it against a project’s own documentation and threat model, remove duplicates, and only then prioritize it for a maintainer’s attention. Among the confirmed results so far is a high-severity, remote, unauthenticated use-after-free bug in nginx’s HTTP/3 handling, exactly the kind of memory-safety issue a purely automated scanner tends to either miss entirely or bury under false positives.

As of early August 2026, the program’s live dashboard shows 1,137 potential issues found across 46 codebases, including curl, Python, Go, NATS, Valkey, Sigstore, RustCrypto, and Let’s Encrypt. Of those, 866 are still awaiting a patch, 125 have fixes open upstream, and 146 have already been merged, figures that will keep moving as the program continues, and a useful real-time reminder that remediation is far slower than discovery, even with AI doing the initial legwork.

Auditing the AI Itself: The Perplexity Comet Case

Trail of Bits’ AI and machine-learning practice is not only about using AI to audit code faster; it also audits AI products as their own distinct attack surface. Ahead of the public launch of Perplexity’s agentic browser Comet, the firm ran a pre-launch engagement using its own TRAIL threat-modeling process, splitting the browser into two trust zones, the user’s local machine and Perplexity’s own servers. The review surfaced four distinct prompt-injection techniques capable of exfiltrating a user’s Gmail inbox to an attacker-controlled server, triggered by nothing more than asking the browser’s AI assistant to summarize an ordinary-looking, attacker-controlled web page. All four were fixed before launch.

The same attack surface is expanding fast inside crypto itself, where autonomous or semi-autonomous agents increasingly hold API keys, execute trades, and interact with wallets on a human’s behalf. HOGE Wire has tracked this shift closely, including how the ElizaOS framework keeps shipping agent infrastructure even as its own token has struggled, a reminder that an agent framework’s security and its token’s price are two entirely separate questions. A prompt-injection bug in a crypto agent with wallet access is not a hypothetical extension of the Comet findings; it is the same bug class pointed at a system that can move funds directly instead of just an inbox. Proving what an AI actually did, rather than trusting what it reported doing, is also the exact problem zero-knowledge machine learning is trying to solve from the cryptography side, by making an AI’s output verifiable rather than merely trusted.

Who Pays for This, and Who Regulates It

None of this is cheap, and none of it is mandatory. Industry pricing, drawn from grant filings and public write-ups, generally runs around $25,000 per engineer per week, putting a typical enterprise engagement somewhere between $80,000 and $200,000; boutique firms will scope smaller reviews starting around $8,000. Large, multi-firm programs run far past that ceiling. Aave’s v4 Security by Design program, a $1.5 million effort ratified by the Aave DAO that ran Certora, ChainSecurity, Trail of Bits, and Blackthorn alongside independent researchers over nearly a year, logged about 345 combined review days and closed with a six-week public contest on Sherlock that drew more than 900 verified participants and over 950 submitted findings. The result, according to The Block, was no critical or high-severity vulnerabilities found, a useful positive counterweight to Balancer and Bunni, and a fair demonstration of what it actually costs to get closer to that outcome.

No regulator, in the United States or anywhere else, licenses or accredits smart-contract auditors the way the Public Company Accounting Oversight Board accredits financial statement auditors. The SEC has leaned toward requiring disclosure of third-party audits in securities filings rather than accrediting who is qualified to perform one, and it has no jurisdiction at all over a fully decentralized protocol with no registered issuer standing behind it. HOGE Wire’s own look at the SEC’s enforcement record found a similar pattern one level up: a regulator that can punish fraud after the fact but has no mechanism to mandate a specific security practice before one happens. Quality in this industry is policed by reputation, and by the market noticing, slowly and expensively, when reputation and reality drift apart.

Where to Verify an Audit Yourself

The most useful habit for anyone putting real money into a protocol is to stop trusting the word “audited” on a landing page and go find the report itself. Trail of Bits publishes its own catalog of more than 600 reports across roughly two dozen client groups at trailofbits.com/reports, and mirrors the raw documents on GitHub. Solodit aggregates tens of thousands of findings across Trail of Bits, OpenZeppelin, Code4rena, Sherlock, and most other major firms and contest platforms into one searchable index. DeFiSafety runs an independent process-quality score from 0 to 100 across its own six dimensions, code and team, documentation, testing, security, admin controls, and oracles, deliberately different categories from Trail of Bits’ own maturity model, which makes it a useful second opinion precisely because the two frameworks do not grade the same things the same way. And because a report only ever covers the code that existed on the day it was written, the last step is always the one OpenZeppelin’s Balancer timeline makes obvious: check the deployed contract’s bytecode against the audited commit hash on a block explorer, rather than assuming the two are still the same thing months or years later.

Frequently Asked Questions

What is Trail of Bits known for in crypto security?

Trail of Bits is a New York based security research firm, founded in 2012 by Dan Guido and Alex Sotirov, known for auditing major crypto protocols including Uniswap, Aave, MakerDAO, and Chainlink, and for open-source security tools like Slither, Echidna, and Medusa that have become close to an industry standard for reviewing Solidity code.

Did Trail of Bits audit Balancer before its 2025 hack?

Yes. Trail of Bits audited Balancer in October 2021 and flagged a rounding-direction issue in its Linear Pools, tracked as finding TOB-BALANCER-004, but marked its severity as undetermined at the time. The same underlying weakness resurfaced in Balancer’s Composable Stable Pools and was exploited on November 3, 2025, for more than $100 million across nine blockchain networks.

What is the difference between Slither and Echidna?

Slither is a static analyzer: it reads Solidity or Vyper source code without executing it and flags known bug patterns almost instantly. Echidna is a property-based fuzzer: developers define invariants that should always hold, and Echidna actively runs and mutates transactions trying to break them. Medusa is Trail of Bits’ newer, faster successor to Echidna, built on go-ethereum with coverage-guided parallel fuzzing.

Does a Trail of Bits audit guarantee a smart contract is safe?

No. An audit reduces risk in the areas it actually tests within a fixed time budget; it does not eliminate risk. It only covers the exact code that existed when the engagement ended, so contracts added afterward, key-management practices, governance design, and cross-chain trust assumptions can all fall outside its scope entirely, as both the Balancer and Bunni cases showed in 2025.

How much does a Trail of Bits security audit cost?

Industry pricing generally runs around $25,000 per engineer per week, putting a typical engagement between $80,000 and $200,000, though large multi-firm programs can run well past that; Aave’s v4 security program, which included Trail of Bits alongside three other firms, was budgeted at $1.5 million in total.

Written by the HOGE Wire security desk.