Crypto Hack Losses Hit $972M as Operational Failures Surge

None of this means code vulnerabilities are solved. 93.9% of programs running five years or more surface a confirmed critical bug, and roughly one in five confirmed reports is rated critical, per Immunefi data. Every protocol upgrade ships fresh attack surface. What has changed is that continuous, incentivized review now keeps pace with attackers on the code layer itself.

“That same discipline now has to cover the keys, the signers and the rules of governance, or we will continue to see catastrophic losses,” Amador said.

A standard audit verifies code at a single point in time. It says nothing about who holds signing authority, how a key is stored or what happens when a laptop is compromised. One protocol was audited 11 times and still lost $128 million, Amador noted.

What has hardened contract code is continuous, incentivized pressure: live bug bounty programs, monitoring and rapid response. Security researchers are paid to find vulnerabilities before an attacker does. A roughly $20,000 median bounty routinely prevents a hack that would average around $25 million, making that payout the highest-ROI security spend a protocol can make, Amador said. The model works because it never stops and incentives do not decay when the org chart changes or a signer leaves.

“So does an audit make a protocol secure? On its own, no,” Amador said. “A protocol is secure when its code, its keys, its people, its governance and its monitoring are all treated as a live attack surface, and tested continuously by researchers paid to break them first.”