- Crypto hacks increasingly exploit operational weaknesses, such as stolen keys, poor governance, and weak treasury controls—not just smart contracts.
- Audits alone are insufficient because they cannot protect keys, people, governance, or future code changes.
- Continuous monitoring, bug bounties, and strong security controls are essential for preventing major losses.
It was reported that a hacker withdrew about $20 million from BonkDAO’s treasury after spending just $4 million. There was no smart contract failure. Instead, the attacker simply purchased enough tokens to secure the passage of a proposal in a vote that had very few participants. It turned out that the governance rules—not the code—were the weak point.
Similarly, in June, another major incident occurred, but from a different angle. Humanity Protocol suffered its biggest loss, totaling $30 million. This breach resulted from the compromise of a team member’s private key. As a result, the attackers gained access without exploiting the project’s smart contracts.
Crypto losses have reached nearly $972 million in 2026, with the number of security breaches continuing to rise. However, most losses now stem from operational failures—such as stolen private keys, misconfigured verification systems, and weak treasury controls—rather than smart contract exploits.
An analysis of 425 crypto hacks between 2021 and 2025 found that a relatively small number of operational security failures accounted for most losses. Between 2024 and 2025, 54.6% of the value stolen across 191 incidents came from centralized exchange breaches involving custody, key management, and transaction-signing systems.
Nevertheless, this does not mean the code layer has been fully secured. Critical vulnerabilities still exist. Approximately 94% of programs that have been operating for five years or more contain at least one critical vulnerability. Meanwhile, about one in five reported vulnerabilities is classified as critical. Every time a new upgrade is deployed, it introduces another potential point of weakness.
This is where traditional security measures reach their limits. A smart contract audit only evaluates code at a specific point in time. It cannot guarantee the security of private keys, signing permissions, or devices that may later be compromised. While audits remain a critical part of blockchain security, they should not be mistaken for complete protection. In one case, a protocol underwent 11 audits yet still suffered a $128 million exploit.
What has proven more effective is continuous security testing. Ongoing bug bounty programs, combined with real-time monitoring and rapid incident response, reward ethical hackers for discovering vulnerabilities before malicious actors can exploit them. With a median bounty of about $20,000, these programs often prevent attacks that could cost an average of $25 million, making them one of the most cost-effective security investments. Their strength lies in continuous operation and incentive structures that remain effective regardless of personnel changes.
The same level of discipline must also be applied to private keys, key holders, and governance rules. Otherwise, these costly security breaches will continue to occur.
So, the question is, do audits make projects secure? On their own, the answer is no.
A project is only truly secure when its code, private keys, governance structure, personnel, and monitoring systems are all treated as potential attack surfaces. These areas must be continuously tested and challenged by security researchers before malicious actors have the opportunity to exploit them.
Free Telegram Channel 
