Skip to content
Qubitron Security

4 min readQubitron Labs security team

2026's biggest crypto losses weren't smart contract bugs. Audit anyway

Signers, RPC nodes, credentials and price manipulation drove 2026's largest losses, while code bugs were the most frequent. What that means for a smart contract audit's scope.

  • Smart contracts
  • Web3
  • Audits

If you read only the headlines, 2026 looks like a year of hacked smart contracts. Read the post-mortems and a different picture appears: the largest losses came from people, keys, infrastructure and economic design. Contract bugs were everywhere, but they were rarely the nine-figure ones.

That doesn't make audits less useful. It changes what a good audit has to look at.

The numbers so far

The two big trackers count differently, so treat the totals as ranges, not facts.

  • CertiK, first half of 2026: about $1.32 billion lost across 344 incidents. Wallet compromise cost the most, about $444.5 million over 33 incidents. Code vulnerabilities were the most frequent vector, 204 incidents, but cost about $151.6 million.
  • TRM Labs, first half of 2026: 207 hacks and USD 972 million stolen, down from USD 2.3 billion a year earlier. Smart contract exploits were 125 of the 207 incidents, while infrastructure and operational compromises were roughly 15% of incidents and about 76% of losses.
  • Third quarter: Cointelegraph, citing CertiK data, put Q3 losses at $1.26 billion across 247 incidents. Treat it as provisional until CertiK publishes its quarterly report.

Same events, different labels: one tracker's "wallet compromise" is another's "infrastructure". The direction is consistent, though. Bugs are common and cheap; operational failures are rare and expensive.

The biggest 2026 losses, and what actually failed

  • Bitget, about $387 million (Q3). Chainalysis covered the theft. Bitget's own statement, carried by Cointelegraph, describes attackers exploiting a vulnerability in a third-party security product: a credential compromise, not a contract bug.
  • Liquid Network, an estimated $320 million (September). Halborn attributes it to a flaw believed to be in the network's proof verification code: node software, not a smart contract. Most of the BTC was later returned.
  • KelpDAO, about $292 million (April). The rsETH bridge relied on a single verifier. Attackers poisoned two of the RPC nodes it read from and knocked out a third. Chainalysis is blunt: "This was not a smart contract vulnerability."
  • Drift Protocol, about $285 million (April). According to Drift's own investigation, summarised by Chainalysis, signers were socially engineered into pre-signing transactions that handed over admin control.
  • Tectonic on Cronos (August). An attacker pumped a thinly traded token used as collateral and borrowed against it. TRM Labs called it price manipulation, noting the protocol's code "works exactly as written", and counted 32 price-manipulation exploits in 2026, an all-time high.

Audited code still gets exploited

Two cases show why an audit is a point-in-time review, not a certificate.

  • Balancer v2, November 2025. More than $100 million was drained through a rounding-direction error. Trail of Bits says its 2021 review had flagged the same issue, rated at undetermined severity.
  • Denaria, April 2026. A smaller loss, about $165,600, from a rounding bug that BlockSec says was introduced in a refactor after the final external audit.

AI is learning to find these bugs

Two 2025-26 benchmarks show AI models getting good at exploiting known contract bugs, in sandboxes.

  • Anthropic's red team had models build exploits for contracts that were really exploited in the past. On contracts exploited after the models' training cutoffs, the exploits were worth $4.6 million in simulation. Scanning 2,849 recently deployed contracts, two agents found two new zero-days worth $3,694, with GPT-5 doing it for $3,476 in API cost. Anthropic stresses it "never tested exploits on live blockchains".
  • Paradigm says that when its EVMbench project started, top models could exploit under 20% of critical bugs from Code4rena contests; GPT-5.3-Codex now exploits over 70%.

Neither shows AI attacking live contracts. Both show that finding a known class of bug in your code is getting cheaper for everyone, attackers included.

What a 2026 audit should cover

Line-by-line review of the contracts still matters most. But the losses above argue for widening the scope:

  • Privileged roles and signers. Who can upgrade, pause or move funds, how many signatures that takes, and what a socially engineered signer could approve.
  • Verifier and oracle configuration. Single points of trust, such as one verifier, one RPC provider or one thin market used as a price.
  • Economic parameters. Collateral factors and liquidity assumptions for every asset you accept.
  • Upgrade paths and deployment scripts, not only the contract source.
  • Changes after the audit. Re-review any refactor, however small, before it ships.

Our smart contract audit states its scope and assumptions in the report, so readers know what was and wasn't covered.

Sources

Keep reading

All posts

Next step

Find out what your app gives away. Book a free exposure call.

Thirty minutes with an engineer, not a sales deck. Tell us what you ship; we tell you what we'd look at first and what an audit would involve.

Book a free exposure callRequest an audit

We only test applications you own or are explicitly authorized to test.