CertiK says DeFi attackers are increasingly targeting operational security and supply-chain weaknesses instead of smart contract bugs.