Audit, Bounty, Insurance: Who Pays After a 2026 Crypto Hack?

The third quarter of 2026 was the most expensive stretch that crypto security has ever recorded. CertiK counted 247 incidents and roughly $1.26 billion in losses between July and September, with September alone, the worst month of the year, accounting for well over $750 million. The quarter was up almost 54 percent on the $819 million lost in the second.

A separate quarterly review made the uncomfortable part explicit. Of the money stolen, about 77 percent, roughly $906 million, walked out through code and infrastructure that no audit had ever examined: compromised suppliers, developer tooling, external infrastructure and signing authorities. The pattern held all year. As one tally put it, the same attack keeps working, and it has very little to do with the smart contracts that auditors actually read.

On 4 November, Immunefi published a quarterly note arguing that the sums paid to catch bugs in advance are trivial next to the sums lost when they are not. Both claims are true, and the tension between them is the subject of this review. A protocol spends tens of thousands of dollars on an audit, adds a bug bounty, and tells its users it has been secured. Then it is drained, and the users learn that none of those products was ever designed to give them their money back.

Crypto’s security industry sells three different things and markets them as a single promise. An audit is a report. A bug bounty is a warning system. On-chain cover is the only one of the three built to actually refund a victim, and it protects less than 2 percent of the value at risk. What follows ranks those three layers not by how clever the engineering is, but by the only measure that matters the morning after a hack: did anyone get paid back?

Three Products Sold as One Promise

Start by separating what the money buys. An audit is a fixed-scope review of a codebase at a single moment in time. A team of engineers reads the contracts, runs tooling, and delivers a document listing what they found and what they recommend fixing. A bug bounty is a standing offer: anyone who finds a vulnerability and discloses it privately gets paid, so that friendly researchers reach the flaw before criminals do. On-chain cover is a paid policy: a buyer pays a premium, and if a defined loss occurs, a capital pool pays a claim.

The three are complements, not substitutes, and projects routinely blur them. A landing page that advertises two audits and a live bug bounty is describing two forms of prevention while implying a third thing, protection, that it has not bought. The distinction is invisible until the day of a loss, when it becomes the only thing that matters. Audited, monitored and insured are three different words, and in 2026 they are not synonyms.

Layer One: The Audit Is a Report, Not a Refund

The audit is the oldest and most recognised layer, and the most misunderstood. A smart-contract audit is a snapshot: engineers review a specific commit, on a specific scope, over a few weeks, and hand back findings. It is genuinely valuable, and it is not a guarantee. Read the engagement contract and the point is spelled out in the fine print. Audit agreements almost universally disclaim financial liability: the work is provided as-is, the client indemnifies the firm, and any damages are capped at the fees paid. The report is a professional opinion, not a warranty, and it expires the moment the code changes.

Nothing in the United States changes that. No regulator accredits smart-contract auditors, mandates a code review, or runs a PCAOB-style oversight body for Solidity. The Securities and Exchange Commission under chair Paul Atkins has spent the year on token classification through its Project Crypto agenda, not on code-review standards. With no legal floor, reputation is the only sanction, and it is a soft one: the worst that happens to a firm after a missed bug is a bad week on social media and a defensive blog post.

Price reflects that soft accountability. A 2026 market reference from Sherlock puts audits anywhere from about $5,000 for something simple to $250,000 and up for an enterprise engagement, with most serious DeFi reviews landing between $50,000 and $100,000 and surcharges for Rust, Move and zero-knowledge work. The Ethereum Foundation judged the cost high enough to launch a $1 million subsidy in April, covering up to 30 percent of audit fees for builders and paying out only after the findings are fixed.

Why Audits Keep Missing the Money

The problem is not that auditors are bad at reading code. It is that the money mostly leaves through doors the audit never opens. The 77 percent of third-quarter losses that fell outside audit scope is not an anomaly; it is the shape of the whole year. CertiK co-founder and chief executive Ronghui Gu told Forbes that attackers now earn better returns by going after key management, multisignature governance and operational infrastructure than by hunting for bugs in contract code, and that wallet breaches alone cost more than $444 million in the first half of 2026, the highest average loss per incident of any category.

The marquee cases make it concrete. When liquid-restaking protocol Kelp lost about $292 million in April, OpenZeppelin’s post-mortem carried the title $292 Million Lost, Zero Bugs Found and the blunt observation that the contracts performed exactly as written; the breach came through an off-chain cross-chain verifier configuration, not the Solidity. Cetus, on Sui, lost about $223 million in May 2025 to an integer overflow that three separate audit firms had reviewed without flagging as critical. And Balancer, drained of roughly $128 million in November 2025 through a rounding error in its stable-pool math, had been audited more than ten times by four firms. Suhail Kakar, a developer-relations lead at TAC Blockchain, put the reaction bluntly after the Balancer hack: “audited by X means almost nothing. Code is hard, DeFi is harder.”

The pattern repeats across the costliest breaches of 2025 and 2026, and it carries the real lesson. In each case the money came back, when it came back at all, from validators, white-hat researchers, the attacker, or a company’s own treasury, never from an insurer. Investigators tied the roughly $387 million Bitget theft in September, the year’s largest, to North Korea-linked actors; Bitget made customers whole from its own pre-funded User Protection Fund, not from any insurance claim, a reminder that even a large exchange self-insures.

Layer Two: The Bug Bounty, Paying Hackers to Warn You First

If an audit is a scheduled inspection, a bug bounty is an open door with cash behind it. Immunefi, the largest marketplace, has paid out more than $140 million over its lifetime to a community of more than 90,000 researchers, and says its programs protect over $180 billion across more than 650 protocols. In the first half of 2026 it routed about $13.45 million to researchers for 837 valid reports. The biggest individual rewards are large by any measure: a $10 million payout to the researcher known as satya0x for a 2022 Wormhole disclosure, standing programs worth $15.5 million for Uniswap v4 and $15 million for LayerZero, and a $16 million Usual bounty run through Sherlock that is billed as the largest single bug bounty in tech history.

Do bounties work? Immunefi’s own research, across 593 programs from January 2021 to February 2026, found that 94 percent of programs that ran for five years surfaced at least one paid critical vulnerability, with a median critical payout of $20,000 and a mean of about $114,000. Founder and chief executive Mitchell Amador frames the broader numbers as a learning curve: “Crypto security is adversarial, and it never stops evolving. The honest read on the numbers is simple: the industry is learning.”

But note what a bounty is and is not. It pays a friendly researcher to find a flaw before a criminal does. It is prevention, bought one disclosed bug at a time. If no researcher finds the bug, or a criminal finds it first, the bounty pays nothing, and the user who was drained has no claim on it. The hunter gets paid; the victim does not. A bounty lowers the odds of a loss and shrinks the blast radius when one happens, which is worth a great deal to a protocol. It is not, and was never meant to be, a fund that reimburses the people who were already holding the position.

A Bounty Costs Less Than a Breach, Which Is the Point

That is the case Immunefi made on 4 November, when it reported that protocols paid researchers about $4.6 million across its programs in the third quarter, up 54 percent from $3 million a year earlier, with about $2.2 million of that for critical bugs. Set the $4.6 million spent on prevention against the $1.26 billion lost in the same quarter and the economics look obvious: paying to catch even a fraction of those bugs early is spectacularly cheap insurance for the protocol. The whole industry’s visible researcher spend in a quarter would not cover a single one of the year’s mid-sized hacks.

The number is also a sleight of hand if you are a user rather than a protocol. Money spent to prevent a hack and money spent to refund a victim are different budgets, and almost all of the industry’s spending sits in the first. A cheap, effective prevention layer is good news for a protocol’s balance sheet and cold comfort to someone whose position was emptied before the white-hats arrived. Prevention lowers the probability of a loss; it does nothing to restore one that already happened. Those are not the same product, even when the same company sells both.

Layer Three: On-Chain Cover, the Only Layer Built to Pay You Back

Only the third layer is designed to put money back in a victim’s wallet, and the way it works matters. The dominant provider is Nexus Mutual, and it is a discretionary mutual, not a licensed insurer. Members pool capital; a buyer purchases cover on a specific protocol or risk for a defined term; and when a loss occurs, a small claims committee votes, usually within 72 hours, on whether to pay from the shared pool. As of mid-October 2026 Nexus listed 17 cover products, from Single and Multi Protocol Cover to a Non-EVM Protocol Cover, an ETH Slashing Umbrella, a Fund Portfolio Cover and a Sherlock Bug Bounty Cover.

Its track record is real but small. Nexus says it has covered more than $6.5 billion in value since 2019 and paid out just over $18.5 million in claims, with its largest payouts following the FTX collapse (about $7.3 million), the TribeDAO exploit (about $5 million) and the Euler Finance hack (about $3.4 million), according to The Token Dispatch. Read that twice. The entire history of the layer that actually refunds people amounts to less than $19 million paid, over seven years, through the category’s leading provider. The largest single hack of 2026 was bigger, on its own, than every claim that provider has ever settled combined.

The regulatory status underlines the point for a United States reader. A discretionary mutual is deliberately not a state-regulated insurance product; members vote on claims, and there is no insurance guaranty fund standing behind a payout. It is closer to a club that agrees to help its members than to an insurer bound by law to indemnify them. That design keeps it outside the reach of state insurance regulators, and it also means a holder has a claim right only in the loose, discretionary sense, not the legally enforceable one a traditional policy confers.

The Coverage Market Is Tiny, and It Is Shrinking

Here is the number that frames everything else. Less than 2 percent of DeFi’s roughly $83 billion in total value locked is covered or insured. The entire on-chain insurance category holds about $123.5 million across 28 active protocols, nearly all of it Nexus Mutual, which works out to about 0.14 percent of the broader DeFi market. Nexus founder Hugh Karp does not soften it: less than 2 percent coverage is, he told CoinDesk, “one of the largest barriers to real DeFi adoption,” and the sums paid so far are “a fraction of what the market needs.”

Worse, the challengers are vanishing. Sherlock’s coverage pool fell from about $60 million to $505,000 in a single year, according to The Token Dispatch; InsurAce, which peaked near $150 million, is down to about $132,000; and Unslashed is effectively obsolete, with a couple of million dollars stranded in old code. The layer that exists to pay victims is not scaling with the losses. It is contracting while the losses set records, which is the opposite of what a functioning insurance market does when claims rise.

Why Rational Users Refuse to Insure

The coverage gap is not mainly apathy. It is arithmetic. On-chain cover typically costs between 1.5 and 6 percent of the insured amount per year, and a great deal of DeFi yield sits in the same 3 to 5 percent range. Buy cover and you can hand back most or all of your return, and sometimes more than all of it. The Token Dispatch laid out the math across common positions, and for several of them insuring the position turns a thin yield negative.

Seen that way, skipping cover is the rational default, not a mistake. Karp concedes the point: for many risks the premiums required become prohibitively expensive, and when nobody buys cover, the cost of a hack falls disproportionately on the least sophisticated participants, the retail users least able to model the risk in the first place. The same tension runs through every yield product in the market, where real yield is picked apart precisely because a few points of return are hard to come by. Spending them on insurance against a tail risk that most users never personally experience is a very tough sell, and the market has voted accordingly.

What Cover Does Not Cover

Even the buyers who want protection run into a crueler problem: the biggest losses are often the ones cover handles worst. Centralised-exchange hacks like Bitget are not on-chain protocol risk at all, so a Nexus policy on a DeFi pool would never touch them. Cross-chain bridges are among the most drained categories in crypto, and Karp has been candid that the core failure mode of bridge risk is not something that would have been covered. And the dominant vector of 2026, compromised keys, phishing and social engineering, is off-chain by nature. Karp notes that many of the largest hacks have originated off-chain from operational security failures, including compromised private keys, phishing scams and social engineering, exactly the events a smart-contract cover policy is not written to pay.

That is the same 76 to 77 percent of value that falls outside audits, viewed from the insurance side. The two layers that soak up almost all of the industry’s security spending, audits and bounties, concentrate on the cheap and common vector of contract code, while the one layer that refunds victims is thinnest exactly where the money actually goes: keys, infrastructure and custody. Users can shrink that exposure, but mostly through old-fashioned hygiene rather than a policy: guarding keys, slowing down at the signing screen, and treating unsolicited Telegram and Discord messages as hostile by default. Self-defense is cheaper than cover, and for the vectors that dominate the loss tables it is often the only defense on offer.

The Hybrid Layer: When a Bounty Becomes a Policy

The industry knows the gap, and its most interesting products try to bridge prevention and compensation. Sherlock pioneered the audit-plus-coverage model, bundling a review with a coverage pool that pays out when an in-scope bug is exploited, which is the closest thing in crypto to an auditor putting its own money behind its work. A joint product from Immunefi, Cantina and Sherlock called Bug Bounty Cover lets a protocol pay only about 20 percent of a critical bounty out of pocket while a mutual covers the rest up to a policy limit, which is why Nexus now lists a Sherlock Bug Bounty Cover among its products. There is even a precedent that the model can pay: an excess-cover arrangement produced a claim after the 2023 Euler Finance incident.

These are the right idea at the wrong size. A handful of million-dollar cover pools and a scattering of seven-figure claims do not change the headline: the compensation layer is a rounding error next to the losses. Fusing a bounty to a policy is clever financial engineering, but it cannot manufacture capital that the market has not put up. Until underwriting capacity grows by an order of magnitude, the hybrid layer is a demonstration, not a backstop.

Made Whole Usually Means Fresh Money, Not Recovered Money

When users are made whole, it is worth asking where the money comes from, because the answer is almost never a coverage pool. It is usually one of four things: a protocol’s treasury or foundation eating the loss, validators freezing and returning funds (as on Sui after Cetus), white-hats or the attacker handing money back for a reward (as in Balancer’s case, where a reimbursement plan distributed only about $8 million of recovered funds against a $128 million loss), or a centralised exchange refilling customer balances from its own capital. After the Bybit breach, the exchange restored balances with fresh capital, bridge loans and large deposits rather than by recovering the stolen funds, which is the tell: being made whole is a corporate decision, not a claim.

Recovery itself is the exception. Independent trackers put the share of stolen value returned or frozen in the first half of 2026 at well under a fifth of incidents, and the same Q3 review that flagged the audit-scope gap found that only about a third of the quarter’s losses were returned or reversed, with roughly $384 million simply gone and most of the rest absorbed by the operators themselves. Being made whole, in other words, is a balance-sheet decision by a solvent and willing company, not a claim paid by a security layer. When the company is neither solvent nor willing, the loss stays exactly where it landed, with the user.

No Regulator Grades Any of This

Step back and the structural problem is an accountability vacuum. In the United States, no regulator accredits smart-contract auditors, mandates a code review, or licenses an on-chain cover provider as an insurer with the capital and conduct rules that the word implies. The SEC’s Project Crypto work under chair Paul Atkins is about deciding which tokens are securities, not about how code is reviewed or how claims are paid. Traditional financial audits carry statutory liability and sit under a public oversight board; their crypto namesakes carry neither, and the on-chain cover providers deliberately sit outside the insurance rulebook altogether.

The result is that reputation is the only court, and it convenes after the fact. When a protocol falls, the auditor publishes a post-mortem, the bounty platform tallies the payouts it made, the forensic firms trace the funds, and the user absorbs the loss. Nothing in that sequence is a promise to pay, because nobody ever sold one. The closest thing to a mandate anywhere is the European Union’s DORA regime, which forces operational-resilience testing on centralised crypto providers; even that does not reach a line of Solidity or guarantee a single refund.

How to Protect a Position When Nothing Refunds You

The practical takeaways follow directly from the three layers.

• Treat audited as the beginning of diligence, not the end. Confirm the audit covers the code that is actually deployed (version, scope and contract address), read the real report rather than a badge, and check that the findings were fixed.
• Look for living defenses: continuous monitoring and an active, well-funded bug bounty. A dormant bounty page is a warning sign, not a reassurance.
• Check whether cover for the protocol even exists, and price it against your yield. If the premium would eat the return, that is information about how risky the market thinks the position is.
• Assume the largest risks are off-chain. Protect keys with hardware signing, slow down before approving transactions, and treat inbound direct messages as hostile.
• Diversify across protocols and custody rather than concentrating in one contract or one bridge.

The point carries to the institutions now arriving through regulated products. As the altcoin ETF wave pulls more conservative capital toward crypto, the coverage gap becomes the question allocators ask first: serious money does not scale into a market that cannot insure itself. The missing layer is not a retail inconvenience; it is a ceiling on adoption, and the people selling audits and bounties know it.

The Verdict: Report, Warning, Refund

Rank the three layers by the question victims actually ask and the order inverts the one the market funds. Audits come first in spending and keep missing the roughly three-quarters of value that leaves outside their scope. Bounties come second and pay the hunter, not the person who was drained. Cover comes last in spending and is the only layer built to pay the victim, and it reaches under 2 percent of the value at risk while shrinking. By the measure that matters the morning after, the ranking is cover, then nothing, then the two layers everyone already buys. That is not a knock on audits or bounties, which do real work; it is a warning about mistaking either one for a refund.

The question of who ultimately pays for security runs through all of crypto, from a cover pool that cannot scale to Bitcoin’s own security budget. The fix for the compensation gap is unglamorous: more capital in the cover layer, priced where it can compete with yield, and products that fuse prevention to payment at a size that matters. Until that capital shows up, secured will keep meaning reviewed, not refunded, and the user will remain the insurer of last resort.

Frequently Asked Questions

Does a smart-contract audit mean my funds are insured?

No. An audit is a point-in-time code review that produces a report; it carries no financial liability and refunds nothing if the protocol is hacked. Insurance, or on-chain cover, is a separate paid product, and in 2026 it protects less than 2 percent of the value in DeFi.

What is the difference between a bug bounty and insurance?

A bug bounty pays an outside researcher to find and privately disclose a vulnerability before criminals exploit it, so it is a prevention tool. Insurance pays a user back after a covered loss has already happened. One lowers the chance of a hack; the other compensates you if one occurs.

Who actually pays victims back after a crypto hack?

Rarely an insurer. Refunds usually come from the protocol’s own treasury, validators freezing funds, white-hats or the attacker returning money for a reward, or a centralised exchange refilling balances from its capital. Industry recovery rates in 2026 ran roughly between 7 and 33 percent of stolen value, so most losses are never returned at all.

How much does DeFi insurance cost, and why does almost no one buy it?

On-chain cover typically costs between 1.5 and 6 percent of the insured amount per year. Because many DeFi yields sit around 3 to 5 percent, buying cover can erase or even invert the return, so most users rationally skip it. That is the main reason under 2 percent of the market is insured.

Is Nexus Mutual a real insurance company?

No. Nexus Mutual is a discretionary mutual, not a state-regulated insurer. Members vote on claims and payouts come from a shared capital pool. It has covered more than $6.5 billion and paid over $18.5 million in claims since 2019, but there is no insurance guaranty fund standing behind it.

By Anneke de Vries, HOGE Wire Security Desk.