The cryptocurrency industry has lost $972 million to hacks so far this year, but a closer look at where that money is actually going reveals an uncomfortable truth: the vulnerabilities being exploited are rarely the smart contract bugs that audits are designed to catch. Instead, attackers are walking out the front door through compromised keys, signers, and governance systems.
The Real Attack Surface
According to analysis from Immunefi's Mitchell Amador, the bulk of 2026's stolen funds did not leave through flaws buried in contract code. They left through the human and operational layers that surround those contracts — private keys that were compromised, signers who were manipulated, and governance mechanisms that were exploited or hijacked.
This distinction matters because it exposes a gap between how the industry talks about security and where the actual risk lives. A protocol can pass every code review imaginable and still be drained if an attacker gains control of the keys that authorize transactions or the multisig arrangements meant to protect them.
"We were audited" was never the same thing as "we are safe."
Why Audits Aren't Enough
The comfort many projects take in having completed a security audit can create a dangerous false sense of protection. An audit typically examines the logic of the code itself, but it cannot guarantee that the people, processes, and access controls operating around that code are equally secure.
Amador argues that the operational side of security — key management, signer verification, and governance safeguards — deserves far more attention than it currently receives. These are the areas where the largest losses are now concentrated, yet they often fall outside the scope of a standard audit.
The pattern seen this year suggests attackers have adapted. As smart contract code has become more scrutinized and hardened, malicious actors have shifted toward softer targets that offer easier access to large sums.
- Compromised private keys authorizing unauthorized transfers
- Manipulated or deceived transaction signers
- Governance systems being exploited or captured
The takeaway for builders and users alike is that genuine security requires looking well beyond the code. Protecting the keys, the signers, and the governance structures may be where the next wave of defensive effort needs to concentrate if the industry hopes to shrink that nine-figure annual loss tally.