Crypto has lost roughly $972 million to hackers so far in 2026, and the largest losses are not flowing out through broken smart contract code. They are leaving through stolen private keys, compromised signers and governance rules that attackers can vote their way around, according to Mitchell Amador, founder and chief executive of bug bounty platform Immunefi.
Amador’s argument, published this week in an institutional industry newsletter, comes with a commercial interest attached. Immunefi runs bug bounty programmes for protocols, and the conclusion the analysis reaches is that continuous paid security research is the highest-return spending a protocol can do. The incident data is worth reading on its own terms. The recommendation is the product his company sells.
Governance and Keys, Not Code
This month, an attacker spent approximately $4 million to drain roughly $20 million from BonkDAO’s treasury. No contract failed. The attacker bought enough tokens to pass a governance proposal in a low-turnout vote, and the proposal executed exactly as written. The rules themselves were the vulnerability.
A month earlier, in June, Humanity Protocol recorded that month’s largest loss, more than $30 million, after a private key on a team member’s machine was compromised. The contract was never touched, according to the project’s own account.
Amador’s analysis of 425 hacks spanning 2021 to 2025 found that, in the 2024 to 2025 window alone, 54.6% of all value lost across 191 incidents traced back to centralised exchange compromises, meaning the keys, custody arrangements and signing infrastructure that sit above the contract layer.
The Code Layer Is Not Solved Either
None of this means onchain code is hardened. Amador’s data shows 93.9% of programmes running five years or more surface at least one confirmed critical vulnerability, and roughly one in five confirmed bug reports is rated critical. Every protocol upgrade ships fresh attack surface.
What has changed, he argues, is that continuous incentivised review now keeps pace with attackers on contract code. He sets a median bug bounty payout of roughly $20,000 against exploits that would average around $25 million in losses, and presents that as the highest return a protocol can get from any security spending.
The comparison is worth reading carefully. It measures a median payout against an average loss, which are different things, and a small number of very large hacks pulls an average upwards in a way a median does not follow. The direction of the argument may well hold. The specific ratio is doing more work than the underlying data supports.
Audits Are Not Enough
Amador draws a sharp line between audit coverage and genuine security. An audit verifies code at a single moment in time, he writes. It says nothing about who holds signing authority, how a key is stored, or what happens when a laptop is compromised. To illustrate the gap, he points to one protocol that was audited 11 times and still lost $128 million.
Being audited, Amador writes, was never the same as being safe. He argues that the same continuous incentivised pressure that has hardened contract code must now extend to keys, signers and governance structures, or catastrophic losses in those areas will keep happening.
What Secure Looks Like
A protocol is secure, Amador argues, when its code, keys, personnel, governance and monitoring are all treated as a live attack surface and tested continuously by researchers paid to break them first. The model works, on his account, because the incentives do not decay when an org chart changes or a signer leaves the team.
Two things are worth holding on to. The pattern he describes is corroborated by where this year’s losses have actually come from, and the shift away from contract exploits toward key and governance compromises is real and documented. But the dataset is Immunefi’s own, self-published and not independently verified, and the remedy it arrives at is the service Immunefi sells. Both of those can be true at the same time, and readers should weigh the findings knowing it.
