Crypto Hacks Show Audits Aren't Enough to Prevent Losses

Security audits alone aren't enough to protect crypto projects from hacks, as recent incidents show. Infrastructure and key compromises accounted for 15% of hacking incidents this year but resulted in 76% of the dollars lost. Smart-contract bugs, which audits typically check, made up 60% of incidents but only a small share of the financial damage.

Four separate failures occurred within three weeks, each stemming from decisions made long before the hacks. Allbridge lost $1.65 million on July 20 due to a flaw in a 2023 patch, while AFX lost $24.15 million on July 22 because of compromised signing keys. The attacker bridged the funds to Ethereum and swapped them for roughly 12,467 ETH. AFX offered to let the attacker keep 30% of the funds if the rest were returned, but as of August 9, there was no response.

Triple-A, a stablecoin payments processor, suffered a breach starting July 24, losing funds across seven chains because one operator held every key. However, customer funds were untouched because they were kept in segregated trust accounts. Coldcard users faced a compromise dating back to a 2021 firmware update, leading to the theft of roughly 1,816 BTC in 2026.

LayerZero V2, one of the largest bridges, was behind 2026's biggest DeFi hack, losing $292 million in April. The attack exploited a design flaw where a single verifier could be tricked into reading fake data. Disclosure remains the only verifiable aspect of these hidden risks, with operators often failing to provide critical details about their security measures.