Crypto has lost roughly $972 million to hackers so far in 2026, and the largest losses are not flowing out through broken smart contract code. They are leaving through stolen private keys, co
Crypto has lost roughly $972 million to hackers so far in 2026, and the largest losses are not flowing out through broken smart contract code. They are leaving through stolen private keys, compromised signers and governance rules that attackers can vote their way around, according to Mitchell Amador, founder and chief executive of bug bounty platform Immunefi.
Amador’s argument, published this week in an institutional industry newsletter, comes with a commercial interest attached. Immunefi runs bug bounty programmes for protocols, and the conclusion the analysis reaches is that continuous paid security research is the highest-return spending a protocol can do. The incident data is worth reading on its own terms. The recommendation is the product his company sells.
