Approximately $764 million was stolen from crypto projects in Q2, with 88.3% involving keys, signers, and infrastructure.

According to Odaily, Hacken stated in its Security and Compliance Report for Q2 2026 that institutional investors are expanding their due diligence scope from smart contract audits to include ongoing monitoring, signer control, and incident response preparedness. Among the 1,427 tracked projects, only 9% have third-party monitoring, and just 4% combine monitoring, active bug bounty programs, and security audits. The report shows that out of approximately $764 million in stolen funds during the second quarter, 88.3% involved compromised keys, signers, and infrastructure.

Hacken noted that 14 projects attacked in the second quarter had previously undergone audits, but most losses originated outside the traditional scope of smart contract reviews. According to the report, affected areas include signing devices, cross-chain bridge validators, backend infrastructure, admin keys, and deprecated but still active legacy contracts. The sample covers 1,427 projects listed by the top 50 centralized exchanges according to CoinGecko Trust Score, all with a market cap over $1 million, excluding wrapped assets, stablecoins, and tokenized real-world assets.