CoinDesk
Crypto's biggest hacks are no longer coming from smart-contract bugs — they're coming from operational and human vectors that traditional code audits were never designed to catch, according to new research from Oak Security. Since 2022, malicious actors, most prominently North Korea's Lazarus Group, have stolen more than $2.2 billion across the industry, even as the number of code audits conducted has roughly tripled. Losses and incident counts have not declined meaningfully over the same window, because the majority of successful attacks now target the people and processes around the code rather than the code itself.
The largest exploits now originate from compromised private keys, governance manipulation, insider compromise, malicious dependency updates, and operational failures — not from faulty Solidity or EVM bytecode. Oak Security's analysis is blunt: the industry is still defending against the last generation of attacks, while attackers have moved on. That disconnect has created a dangerous illusion of safety, as platforms market the number of audits they've passed or the reputation of the firms they hired as shorthand for being secure, when in fact an audit is only a snapshot of one codebase under a defined scope, instantly invalidated by any governance change, integration, or operational shift.
Why it matters
Code quality has genuinely improved and audits are doing what they were designed to do. The problem is structural: the costliest attack vectors remain comparatively under-defended because they sit outside the audit's scope. The KelpDAO hack was a recent reminder that users don't draw a distinction between a smart-contract bug and a centralized off-chain point of failure — they just see another supposedly secure protocol lose millions overnight. That pattern directly threatens any credible path to mass adoption, because no rational allocator stakes principal for yield against a narrative of repeated, headline-grade failures.
Market impact
The implication is that defense-in-depth is no longer optional.
Frequently asked questions
-
What are the biggest causes of crypto exploits today?
According to Oak Security, the largest losses now come from compromised private keys, governance manipulation, insider compromise, malicious dependency updates, and operational failures — not from smart-contract code bugs.
-
How much have North Korean-linked hackers stolen from crypto since 2022?
More than $2.2 billion has been stolen by malicious actors — most prominently North Korea's Lazarus Group — since 2022, even as the number of code audits across the industry has roughly tripled.
-
Why aren't more code audits reducing crypto hacks?
Oak Security's research finds a clear mismatch: audits target the codebase, but attackers have shifted to human and operational vectors that sit outside the audit's scope. The result is more audits with no meaningful decline in losses or incidents.
-
What was the KelpDAO hack and why does it matter?
The KelpDAO hack is cited as a recent example of a protocol losing millions through an off-chain or operational failure rather than a smart-contract bug. It illustrates that users don't distinguish between code failures and centralized points of failure — they just see another supposedly secure protocol collapse.
-
What is defense-in-depth in crypto security?
Defense-in-depth means combining strong code review with hardened operational security: key management, signer decentralization, governance constraints, anomaly detection, real-time monitoring, and circuit breakers that make human-vector attacks harder to execute.
CoinTelegraph
Altcoin Daily
TheBlock
Lookonchain
Crypto Capital Venture
Crypto Rank News
WuBlockchain