Are DeFi projects that have passed security audits necessarily safe?

Recently, Yunmeng County in Hubei handed down a bizarre judgment. A team led by He developed a decentralized trading platform. After obtaining a security audit report, they secretly switched the code to a version with a "backdoor" before launching it.

Their scheme was devious: the platform publicly promoted interest-bearing deposits and even issued a platform token called "D token," supporting deposit, withdrawal, lending, and repayment services. Users deposited their tokens and received regular returns. On the surface, everything seemed normal.

But in reality, He and his team manipulated data through the backdoor and secretly swapped users' real pledged tokens for worthless "D tokens." In just two months, 103 people lost a total of 77.76 million RMB.

One of the victims, Mr. Tong, was actually an industry insider working in blockchain. In September 2020, he learned about the project from a friend and thought the model was reliable, so he invested 1 million RMB. On November 19, under the pretense of "D token staking," the platform withdrew all the tokens from his account, leaving him with nothing but a pile of worthless coins.

In March this year, the first trial concluded: He and three others were sentenced to between 3 and 13 years in prison, with fines ranging from 20,000 to 300,000 RMB. He appealed, but the second trial upheld the original verdict.

This incident reminds us: an audit report only proves that a "certain version" of the code has no problems—who knows if it’s secretly swapped after launch? If DeFi’s "decentralization" is just a facade and the backend operates as a black box, it’s no different from a traditional scam. Before investing, check the project's background thoroughly—don’t just look at the PPT and the audit stamp.