Most 2026 Crypto Hacks Exploit Keys and Governance, Not Code Bugs

Nearly $972 million in cryptocurrency has been stolen in 2026, according to a new analysis by Immunefi's Mitchell Amador. Amador notes that the majority of these losses stem from compromised private keys, signers, and governance mechanisms rather than smart contract vulnerabilities. The findings challenge a widespread assumption in the industry that passing a security audit equates to being fully protected. Amador argues that an audit verifies code quality at a single point in time but does not account for ongoing operational and access-control risks.