Institutional investors are looking beyond smart contract audits after traditional trust signals such as prior audits and operating history failed to predict which crypto projects would be exploited, according to Hacken.
In its Q2 2026 Security & Compliance Report, Hacken said that only 9% of 1,427 tracked projects had third-party monitoring, while 4% combined monitoring with an active bug bounty and a security audit. The report highlighted that compromised keys, signers and infrastructure accounted for 88.3% of the roughly $764 million stolen during the quarter.
Hacken said projects unable to provide ongoing evidence of operational security may face higher perceived risk, reduced investment and more difficult access to insurance or counterparties.
Contributors to the report included Federico Bagiotti, group head of risk management at Abraxas Capital, who said “inadequate security relative to the capital at risk” was the signal that most often led the firm to reject an otherwise attractive position. Rajeev Bamra, Moody’s Ratings’ head of digital economy strategy, said that operational resilience had become “the practical lens” through which institutions evaluated security, compliance and governance.
Security controls among those reviewed. Source: Hacken
Operational security becomes an allocation test
The report said institutional due diligence is beginning to include signer-set changes, collateral backing, third-party dependencies, incident-response readiness and the scope and recency of audits. Abraxas said it now explicitly screens for timelocks, withdrawal-address whitelisting, multiparty controls and single-key or single-verifier dependencies.
The shift has also appeared in regulatory and industry scrutiny. In a July 10 Cointelegraph report, BitGo Chief Operating Officer Jody Mettler said institutional clients had begun asking more detailed questions about custody providers’ access controls, incident response and business continuity as European regulators examined operational resilience under the Digital Operational Resilience Act (DORA).
Hacken said 14 projects exploited in the second quarter had previously been audited. However, most losses stemmed from areas outside the scope of conventional smart contract reviews. The affected surfaces included signer devices, bridge validators, backend infrastructure, admin keys and older contracts that remained live despite being deprecated.
The dataset covered 1,427 projects with market caps above $1 million, drawn from assets listed across the top 50 centralized exchanges by CoinGecko Trust Score. Hacken excluded wrapped assets, stablecoins and tokenized real-world assets. Its data relied on publicly observable and disclosed controls, which means that private arrangements may not be captured.