Institutional Investors Move Beyond Audits as Crypto Security Risks Rise

Institutional investors are looking beyond smart contract audits as traditional trust signals failed to predict which crypto projects would be exploited, according to Hacken. According to Cointelegraph, Hacken said in its Q2 2026 Security & Compliance Report that only 9% of 1,427 tracked projects had third-party monitoring, while 4% combined monitoring with an active bug bounty and a security audit. The report said compromised keys, signers and infrastructure accounted for 88.3% of the roughly $764 million stolen during the quarter. Hacken added that projects unable to provide ongoing evidence of operational security may face higher perceived risk, reduced investment and more difficult access to insurance or counterparties. The report said institutional due diligence is increasingly including signer-set changes, collateral backing, third-party dependencies, incident-response readiness and the scope and recency of audits. It also noted that Abraxas Capital now screens for timelocks, withdrawal-address whitelisting, multiparty controls and single-key or single-verifier dependencies. Contributors to the report included Federico Bagiotti, group head of risk management at Abraxas Capital, who said “inadequate security relative to the capital at risk” was the signal that most often led the firm to reject an otherwise attractive position. Rajeev Bamra, Moody’s Ratings’ head of digital economy strategy, said operational resilience had become “the practical lens” through which institutions evaluated security, compliance and governance. Hacken said 14 projects exploited in the second quarter had previously been audited, but most losses came from areas outside conventional smart contract reviews. The affected surfaces included signer devices, bridge validators, backend infrastructure, admin keys and older contracts that remained live despite being deprecated. The dataset covered 1,427 projects with market caps above $1 million, drawn from assets listed across the top 50 centralized exchanges by CoinGecko Trust Score. Hacken excluded wrapped assets, stablecoins and tokenized real-world assets, and said its data relied on publicly observable and disclosed controls, meaning private arrangements may not have been captured.