Institutional investors are increasingly looking beyond smart contract audits as traditional trust signals such as prior audits and operational history fail to predict which crypto projects will be exploited, according to Hacken's Q2 2026 Security & Compliance Report. The report highlights a paradigm shift in due diligence, with emphasis moving toward continuous monitoring, signer controls, and incident readiness.

The Limitations of Smart Contract Audits

Hacken's analysis covered 1,427 projects with market caps above $1 million, drawn from assets listed on top centralized exchanges. Only 9% of these projects had third-party monitoring, while a mere 4% combined monitoring with an active bug bounty and a security audit. The report found that compromised keys, signers, and infrastructure accounted for 88.3% of the roughly $764 million stolen during the second quarter. This indicates that conventional smart contract audits, while valuable, are insufficient to address the primary sources of crypto theft.

Fourteen projects exploited in Q2 had previously been audited. However, most losses originated from areas outside the scope of typical smart contract reviews: signer devices, bridge validators, backend infrastructure, admin keys, and older contracts that remained live despite being deprecated. For institutional investors, this data undermines the reliability of audit reports as standalone trust signals.

Operational Security Becomes Critical

Institutional due diligence is now incorporating signer-set changes, collateral backing, third-party dependencies, incident-response readiness, and the scope and recency of audits. Federico Bagiotti, group head of risk management at Abraxas Capital, stated that "inadequate security relative to the capital at risk" is the signal that most often leads the firm to reject an otherwise attractive position. Abraxas explicitly screens for timelocks, withdrawal-address whitelisting, multiparty controls, and single-key or single-verifier dependencies.

Rajeev Bamra, Moody's Ratings' head of digital economy strategy, noted that operational resilience has become "the practical lens" through which institutions evaluate security, compliance, and governance. This shift reflects a broader recognition that the security of crypto assets depends not only on code integrity but also on the operational practices of the teams managing them.

Regulatory Push Under DORA

The shift toward operational security is further reinforced by regulatory developments, particularly the European Union's Digital Operational Resilience Act (DORA). DORA imposes requirements on financial entities' ICT systems, including testing, incident reporting, and third-party risk management. As reported by Cointelegraph on July 10, BitGo Chief Operating Officer Jody Mettler said institutional clients are asking more detailed questions about custody providers' access controls, incident response, and business continuity in light of DORA.

The regulation is prompting crypto service providers to strengthen their operational frameworks, which in turn influences how institutional investors assess risk. Projects unable to provide ongoing evidence of operational security may face higher perceived risk, reduced investment, and more difficult access to insurance or counterparties, according to Hacken.

Historical Context and Industry Evolution

The crypto industry has experienced numerous high-profile hacks and failures that underscore the importance of operational security. The $600 million Ronin Bridge hack in 2022, for example, resulted from compromised validator keys. The FTX collapse of 2022 revealed failures in governance and asset custody. More recently, incidents involving cross-chain bridges and DeFi protocols have demonstrated that sophisticated smart contract audits do not guarantee safety if key management and infrastructure are weak.

In this environment, institutional investors are learning to look beyond one-time audit snapshots. Continuous monitoring—such as real-time threat detection, anomaly alerts, and periodic penetration testing—has become a key component of due diligence. Bug bounties, which crowdsource security research, are also gaining traction but remain underutilized; only a fraction of projects combine them with monitoring and audits.

What Institutions Are Looking For

Based on Hacken's findings and expert commentary, institutional due diligence now typically includes the following elements:

• Signer controls: Multi-signature wallets, timelocks, and withdrawal-address whitelisting.
• Infrastructure security: Protection of backend servers, validator nodes, and admin keys.
• Incident response plans: Documented procedures for rapid containment and recovery.
• Third-party dependencies: Assessment of how external services (oracles, bridges, custodians) affect security.
• Audit scope and recency: Verification that audits cover relevant code and are updated after major changes.
• Continuous monitoring: Ongoing surveillance of contract activity and network threats.

Abraxas Capital, for example, explicitly requires timelocks on smart contract upgrades, whitelisting of withdrawal addresses, and multiparty controls for any fund movements. These measures aim to reduce the risk of a single point of failure, such as a compromised developer key or a malicious insider.

Data Limitations and Implications

Hacken's dataset relied on publicly observable and disclosed controls, meaning private arrangements may not be captured. The report excluded wrapped assets, stablecoins, and tokenized real-world assets. Despite these limitations, the data provides a clear picture of the industry's security posture: most projects lack the operational safeguards that institutions now demand.

Projects that fail to adopt these measures may find themselves at a competitive disadvantage. Not only will they struggle to attract institutional capital, but they may also face higher insurance premiums or exclusion from custody services. Conversely, projects that demonstrate robust operational security can build trust and differentiate themselves in a crowded market.

The evolution of institutional due diligence in crypto mirrors trends in traditional finance, where operational risk management has become a cornerstone of investment decision-making. As the crypto industry matures, the emphasis on continuous monitoring and proactive security is likely to become standard practice, reshaping how trust is established and maintained in digital asset markets.

Source: Cointelegraph News