Audits Fail: The True Crypto Trust Signal Emerges

Compromised keys and infrastructure, not smart contract exploits, accounted for 88.3% of crypto losses in Q2 2026, shifting how institutional investors evaluate crypto trust signals.

The Headline Number

The $764 million lost in Q2 2026, primarily due to operational vulnerabilities, marks a critical turning point for institutional investors. This figure underscores a fundamental shift: the largest financial risks in crypto are increasingly human and systemic, rather than purely technical flaws in smart contract code. Our read is that the market is maturing beyond a singular focus on code-level security, demanding robust operational safeguards to protect capital.

3 Key Findings

Finding 1: Operational Failures Dominate Losses

This percentage reveals that the vast majority of stolen funds in Q2 2026 stemmed from ‘soft’ vulnerabilities rather than inherent smart contract bugs. It signifies that robust smart contract audits alone are no longer sufficient to secure institutional capital.

Finding 2: Inadequate Continuous Monitoring

According to Hacken’s Q2 2026 Security & Compliance Report, a mere 9% of 1,427 projects employed third-party monitoring. This low adoption rate for continuous oversight highlights a significant gap in the industry’s approach to proactive risk management.

Finding 3: Comprehensive Security Remains Rare

Only a tiny fraction of projects – 4% – combined continuous monitoring with an active bug bounty and a security audit. This figure suggests that comprehensive, multi-layered security postures are still outliers, leaving many projects vulnerable to sophisticated attacks.

What the Data Really Says

The numbers from Hacken’s Q2 2026 Security & Compliance Report paint a clear picture: institutional investors are moving beyond static audits as the sole arbiter of trustworthiness in crypto. The data strongly indicates that traditional crypto trust signals, such as historical audits and operating history, have failed to reliably predict project vulnerabilities. This failure is driving a critical evolution in institutional due diligence, shifting the focus towards continuous operational security and incident readiness.

What we are seeing is a pivot from a reactive, snapshot-based security assessment to a proactive, ongoing one. The dominance of losses from compromised keys, signers, and infrastructure implies that the attack surface has broadened significantly beyond just smart contracts. As Rajeev Bamra, Moody’s Ratings’ head of digital economy strategy, stated, operational resilience has become

“the practical lens”

through which institutions now evaluate security, compliance, and governance. This points to a new standard where ongoing evidence of robust operational security is paramount.

Methodology Note

Implications for CFOs and Finance Leaders

• Re-evaluate Due Diligence Frameworks: CFOs must expand their crypto due diligence beyond smart contract audits to include rigorous assessment of operational resilience, signer controls, and incident response plans.
• Prioritize Continuous Monitoring: Mandate and verify the implementation of continuous third-party monitoring solutions for any crypto assets or projects under consideration. This shifts from point-in-time assessments to ongoing vigilance.
• Assess Insurance & Counterparty Access: Understand that projects unable to provide ongoing evidence of operational security will face higher perceived risk, potentially leading to reduced investment, and more difficult access to insurance or counterparties.
• Demand Operational Transparency: Push for greater transparency from crypto projects regarding their operational security practices, signer controls, and their readiness to manage and respond to incidents. As Federico Bagiotti of Abraxas Capital highlighted,
  

  “inadequate security relative to the capital at risk”

  is a clear red flag.

The Bottom Line

Frequently Asked Questions

What is shifting in institutional crypto due diligence?

Institutional due diligence is moving away from a primary reliance on smart contract audits and operating history. The focus is now on continuous monitoring, stringent signer controls, and a project’s incident readiness, acknowledging that most losses stem from operational rather than code-level failures.

Why are traditional trust signals proving insufficient?

Traditional signals like smart contract audits often provide a snapshot in time, failing to predict vulnerabilities arising from evolving operational risks like compromised keys or inadequate infrastructure. The data shows these ‘soft’ failures are now the dominant source of crypto losses, making static assessments obsolete.

What does ‘operational resilience’ mean for crypto projects?

Operational resilience in crypto means a project’s ability to maintain security and functionality despite internal or external shocks. This includes having robust multi-sig controls, continuous third-party monitoring, clear incident response plans, and active bug bounties to proactively identify and mitigate risks beyond just smart contract code.