Industry voices cited in the report, including Federico Bagiotti of Abraxas Capital and Rajeev Bamra of Moody’s, stress insufficient security relative to capital at risk and view operational resilience as a key evaluation lens.

The dataset covers 1,427 projects with market caps above $1 million from CoinGecko Trust Score top exchanges, excluding wrapped assets, stablecoins, and tokenized real-world assets, and relies on publicly observable controls, noting private arrangements may not be captured.

Hacken notes that 14 investigated projects had prior audits, yet most losses occurred outside traditional smart contract review scopes, including signer devices, bridge validators, backend infrastructure, admin keys, and deprecated live contracts.

Institutional investors are increasingly evaluating operational security beyond traditional audits as trust signals falter, per Hacken’s Q2 2026 Security & Compliance Report.

Only a small fraction of projects have robust third‑party oversight: just 9% of 1,427 tracked crypto projects have third‑party monitoring, and only 4% combine monitoring with an active bug bounty and a security audit.

About $764 million in losses occurred in the quarter, with 88.3% stemming from compromised keys, signers, and infrastructure rather than issues found in standard smart contract reviews.

Regulatory and industry scrutiny is rising in tandem with this shift, with discussions on custody access controls and incident response expanding under frameworks like the EU Digital Operational Resilience Act (DORA).

Institutional due diligence is expanding to include signer-set changes, collateral backing, third-party dependencies, incident-response readiness, and the scope and recency of audits, signaling operational resilience as a core criterion.

Projects failing to demonstrate ongoing operational security evidence face higher perceived risk, reduced investment, and greater challenges obtaining insurance or counterparty access.