CertiK’s $9.2 Billion Year: The Code Held, the Money Left

The firm that sells the promise of safer code spent the first days of November doing the opposite of reassuring anyone. CertiK, the blockchain security company whose stamp sits on thousands of crypto projects, published its October tally and confirmed what the market already feared: 2026 is now the worst year for crypto theft on record. Its running total for the year reached about $9.2 billion, according to figures the firm shared from its live Hack3d dashboard and reported by The Defiant. For comparison, CertiK pegged all of 2025 at roughly $3.35 billion. One month of 2026, October, lost more than the entire prior year.

Here is the part that should unsettle an industry that spends heavily on audits: almost none of that $9.2 billion came from the kind of flaw an auditor is hired to find. The record was not set by a clever reentrancy trick or an integer overflow buried in a smart contract. It was set by stolen signatures, compromised back ends, and abused permissions. The single largest event, the roughly $6.3 billion drained from Binance on 29 October, did not involve a broken line of Solidity at all. CertiK filed it under wallet compromise. The code, in the narrowest sense, held. The money left anyway.

That gap between what audits check and where losses actually happen has a name inside the security trade, the audit paradox, and 2026 pushed it to a scale nobody could ignore. This piece looks at what CertiK’s own ledger says, why the biggest thefts keep slipping past the code review, what an audit badge is actually worth once you understand its limits, and why the company counting the damage is also one of the most conflicted narrators in the business.

What CertiK’s October Ledger Says

Strip the month down to its numbers and the shape is stark. CertiK recorded about $6.5 billion in gross losses across October, with roughly $3.03 billion later frozen or returned, leaving an adjusted net of around $3.47 billion, per data carried by Phemex and Cryptonews. The month ran to roughly 89 separate incidents. Wallet compromise accounted for the highest dollar losses, while the exploit category logged the most individual events. The previous worst month of the year, September, had topped out near $766 million. October did not edge past it; it lapped the field more than eight times over.

The year’s arithmetic is worth sitting with. Through the end of September, CertiK’s trackers had the industry down roughly $2.7 billion across 658 incidents, a punishing figure in any ordinary year. Then a single Friday night added $6.5 billion to the pile. The record $9.2 billion annual total is, in effect, nine quiet-by-comparison months plus one catastrophic twenty-minute window. Remove that one night and 2026 would still rank as a bad year; include it and the chart barely fits on the page.

The large recovery line tells its own story. Historically, most stolen crypto is gone the moment it moves. The reason October showed about $3 billion frozen is that a growing share of the stolen assets were centrally issued stablecoins and tokens whose issuers can hit a kill switch. That same lever, which let stablecoin issuers claw back billions mid-heist, is itself a quiet admission that a lot of modern crypto is less trustless than its marketing suggests. An auditor cannot freeze anything. The partial recovery came from Circle and Tether, not from a line of reviewed code.

The $6.3 Billion Signature

Everything about the Binance theft argues against the idea that a code review is the last line of defense. On the evening of 29 October, attackers drained roughly $6.3 billion from the world’s largest exchange in about twenty minutes, hitting ten blockchains in sequence beginning around 20:05 UTC. Blockchain intelligence firm TRM Labs put the theft-time value at $6.36 billion and called it the largest crypto heist on record, roughly four times the size of 2025’s Bybit hack. Chainalysis and TRM both attributed it, with high confidence, to TraderTraitor, an elite North Korean unit within the broader Lazarus ecosystem.

The mechanism matters more than the headline figure. According to TRM’s reconstruction, this was an infrastructure compromise, not a smart-contract flaw. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, executing 50 authorizations that had been signed in advance and fired in a single burst to outrun the exchange’s own defenses. Across the other chains, the likeliest explanation is that the attacker gained the ability to make Binance’s signing system approve transactions of its choosing, which is why valid signatures surfaced on ten networks within half an hour. We covered the signing mechanics at length in our forensic account of the Binance hack; the short version is that the keys were never stolen in the classic sense. They were made to sign.

Binance confirmed the broad outline. Its executive Richard Teng said the breach involved “a more complex process rather than the misuse of a single engineer’s permissions,” and the exchange said it found no evidence of any wallet private key leak, per CNBC. Binance suspended withdrawals, pledged to cover customer losses through its Secure Asset Fund for Users, and moved to restore services within days. Circle froze more than $800 million in USDC and Tether froze over $1.5 billion in USDT, with Ripple and others pitching in, lifting the frozen total to roughly $2.7 billion. That still left the attacker holding around $2.4 billion, including more than 420,000 ETH and 18,270 BTC. The money crossed Ethereum, where $3.79 billion went, Bitcoin, Tron, the XRP Ledger, and Solana, among others.

Now ask where a smart-contract audit would have intervened. Nowhere. The compromised layer was signing infrastructure, the operational plumbing that turns an authorized instruction into a broadcast transaction. It is the same category of failure that defined the Bybit theft a year earlier, when a poisoned developer workflow tricked signers into approving a malicious transaction while the underlying contract was perfectly correct. These are not bugs in reviewed code. They are failures in how large organizations protect the act of signing, a problem that lives much closer to the human and interface layer of wallets than to any audited contract. CertiK did not audit Binance’s internal systems; here it is the scorekeeper, not the referee. But its own data makes the uncomfortable point for it: the biggest number in the biggest year was booked in a category audits do not touch.

Who CertiK Is, and What an Audit Actually Checks

CertiK is not a fly-by-night badge shop, which is part of what makes the paradox interesting. The company was founded in 2018 in New York by two academics, Ronghui Gu, then at Columbia, and Zhong Shao of Yale. Their credibility came from CertiKOS, a project that in 2016 produced one of the first fully formally verified multi-core operating-system kernels, work that used mathematical proof to show software behaved exactly as specified. The company name nods to that lineage, certified kernel, and the pitch was to bring the same rigor to blockchain code. By its own figures at its October brand relaunch, CertiK claims more than 5,500 clients across 150-plus countries, over 119,000 code vulnerabilities found, and more than $600 billion in assets secured.

Its products fan out from that core. The headline service is still the smart-contract audit, a blend of manual review, automated tooling, and formal verification. Around it sit Skynet, a continuous-monitoring platform that assigns projects a security score; penetration testing; Proof of Reserves attestations; and, increasingly, compliance and risk tooling aimed at institutions. The important thing for a reader trying to judge an audit badge is to understand what the flagship product actually inspects: a specific set of smart contracts, at a specific commit, against a catalog of known vulnerability classes, within a scope the client agrees to pay for.

That scope is the whole story. A contract audit does not review the exchange back end that signs withdrawals. It does not test the laptop of the engineer who holds an admin key. It rarely covers the third-party oracle a protocol trusts for prices, the bridge a token relies on to move between chains, or the governance multisig that can upgrade everything after launch. Each of those lives outside the typical audit boundary, and each has produced nine-figure losses in 2026. The badge says the reviewed code, in isolation, met a standard on a given day. It was never designed to promise that the business wrapped around that code is safe.

The Audit Paradox, Now at Record Scale

The strange thing is that CertiK has been describing this shift for most of the year, in its own data and in the words of its chief executive. Reviewing the first-half numbers, Gu told Forbes that “attackers are getting more return by going after key management, multisig governance, and operational infrastructure than by hunting for bugs in code.” He added a line that reads like an epitaph for the point-in-time audit model: “A project gets audited once before deployment, passes, and then never revisits that code again. The danger window doesn’t close after launch.”

The year’s leaderboard proves him right. Line up the five largest crypto losses of 2026 and only one of them, the Liquid Network’s roughly $319 million in September, traces back to a genuine code vulnerability, a flaw in proof validation that let an attacker mint unbacked assets. The other four, including the record Binance theft, were failures of keys, signing, and operational control. That is not a rounding artifact. It is the central security fact of the year, and it inverts the intuition that most people, and most project marketing, still carry: that a clean audit is the thing standing between a protocol and disaster.

A few caveats keep the table honest. CertiK’s own tally books Bitget at $387.5 million, a touch above the roughly $351.6 million the exchange says actually left its wallets, a gap worth noting rather than smoothing over. Kelp DAO’s loss flowed through the infrastructure around a liquid restaking token rather than through the token’s own contract. And Liquid, the one true code bug in the group, is also the one where most of the money came back, because a white-hat returned the bulk of it, the mirror image of the Binance outcome. Hold that contrast in mind: the year’s clearest audit-style failure was its most recoverable, while the off-code megahacks are where the money tends to vanish for good.

When the Map of Losses Stops Matching the Map of Audits

If the five-largest list feels like an outlier driven by two giant exchange hacks, the category data says otherwise. CertiK’s breakdown of September, the month October dethroned, shows the same pattern in miniature. Classify that month’s losses by the type of weakness exploited and the ranking is almost a photographic negative of what a traditional audit is tuned to catch.

Look at the bottom row. Reentrancy, the vulnerability class at the center of smart-contract security folklore, the bug behind the 2016 DAO hack and a staple of every audit checklist, accounted for about $2.2 million in September, per figures compiled by The Crypto Times. That is the smallest category on the board. The money went instead to third-party service compromises and to signature or proof-validation failures, together close to $712 million. An industry that pours audit budgets into finding the next reentrancy is guarding a door attackers have largely stopped using.

None of this means audits are worthless. Reentrancy losses are small precisely because years of audits, better tooling, and safer libraries made that class of bug rare and expensive to pull off. The problem is subtler and more uncomfortable: security works where it is applied, attackers move to where it is not, and the audit industry’s core product is anchored to a layer that is no longer where the big money leaks out. The map of audits and the map of losses have drifted apart, and 2026 is the year the two stopped overlapping in any meaningful way.

The Narrator Has a Stake

There is an uncomfortable detail behind the October ledger that CertiK does not advertise. Binance was among CertiK’s earliest and largest investors. When CertiK raised at a roughly $2 billion valuation, Binance’s venture arm was the first and biggest check, an eight-figure commitment, as The Block has reported. So the firm now booking the largest line in the worst year of crypto theft is, in part, counting the catastrophe of its own anchor backer.

To be precise about what this is and is not: CertiK did not audit Binance’s internal signing systems, and there is no suggestion it softened the numbers. If anything, it published the Binance loss prominently, and the figure speaks for itself. But the relationship is the kind of thing that matters for a company positioning itself as the neutral scorekeeper of an entire industry, and one that has openly floated plans to go public. A scorekeeper with a financial stake in some of the teams is still a scorekeeper, but readers are entitled to know the stake exists.

CertiK’s own executives frame the exchange-hack wave as an inflection point. When Bitget was drained in September, the firm’s head of capital markets and policy, Esme Pau, called it one of the most substantive centralised exchange exploits of 2026 and “another wake-up call for the digital-assets industry.” Binance, an order of magnitude larger, is that alarm going off a second time, louder, and this time it landed on one of CertiK’s own investors. The optics are not fatal. They are simply a reminder that in crypto security the referee, the players, and the sponsors are often the same small group of people.

CertiK’s Own Record Is Not Spotless

The audit paradox is an industry problem, not a CertiK-specific one, but the firm has handed critics plenty of its own material. The sharpest episode came in June 2024, when CertiK researchers exploited a bug in Kraken’s deposit system and withdrew about $3 million in real customer funds, then, Kraken said, were slow to return it without first discussing a reward. Kraken’s chief security officer, Nick Percoco, was blunt: “This is not white-hat hacking, it is extortion,” he told CoinDesk. CertiK called its work legitimate research and said Kraken had threatened it; the funds were ultimately returned.

Then there is Huione. In late 2024, CertiK audited the smart contract for USDH, a stablecoin tied to Huione Guarantee, a Cambodian marketplace later described by investigators as the largest illicit online marketplace ever assembled, a hub for pig-butchering scams and worse. When the connection became public, CertiK apologized, said it does not condone the marketplace’s activities, noted that it had flagged concerns, assigned the token its lowest Skynet score, and donated the fee. It was a measured response to an ugly situation, but it underlined how an audit can lend technical legitimacy to something that deserves none.

And there is the longer tail of audited-then-drained projects. Swaprum, a decentralized exchange CertiK had audited, pulled an estimated $3 million rug on its users, prompting coverage that framed it as one in a series. The Merlin DEX drain on zkSync followed a strong CertiK rating by days. None of these are the same failure as the off-code megahacks; they are failures or embarrassments of the audit itself. Together they make the same point from the other direction: a badge is a snapshot of code quality on one day, under one scope, and it can be outrun by a malicious developer, a bad client, or simply time.

From Auditor to “Trust Layer”

CertiK has read the same data everyone else has, and its response tells you where it thinks the business is going. At TOKEN2049 in Singapore in early October, the company rebranded from a Web3 security specialist into, in its words, the trust layer for digital value, extending its pitch beyond code audits into compliance, continuous monitoring, and risk tooling for financial institutions and the regulators that oversee them. In the first week of November it expanded its presence in the United Arab Emirates, deepening ties with Abu Dhabi’s Hub71 and the VARA-licensed Gate Dubai, for which it had completed a Proof of Reserves check earlier in the year.

The logic behind the move sits in a line from chief business officer Jason Jiang. “Financial institutions are making real progress in bringing digital assets into financial services, but regulatory approval is only the starting point,” he said. “Protecting customer assets and managing risks as operations scale require continuous security and compliance.” Translated, that is a direct answer to the audit paradox: stop selling a one-time inspection, start selling an ongoing relationship. If the danger window never closes, as Gu put it, then the product should be a subscription, not a certificate.

There is a steelman and a cynical reading, and both are true at once. The steelman: continuous monitoring, Proof of Reserves, and real-time risk scoring genuinely map better onto 2026’s threat surface than a point-in-time audit does. The cynical reading: a firm whose flagship product is losing relevance is enlarging the definition of its job to stay indispensable, and doing so just as it courts a public listing that would reward growth in billable surface area. The move also introduces a fresh conflict. When an auditor also runs validator services and signs Proof of Reserves attestations, it stops being purely an outside reviewer and starts becoming part of the infrastructure it grades. CertiK’s ambition to go public, floated by Gu at Davos and detailed by CoinDesk, only sharpens the question of who audits the auditor.

What an “Audited” Badge Can and Cannot Promise

For anyone deciding whether to trust a protocol or an exchange, the practical lesson of 2026 is to read an audit for what it is: necessary, useful, and badly oversold. A clean report lowers the odds of a specific, well-understood class of bug. It says little about the parts of the system that produced almost all of this year’s losses. Here is a grounded way to read the word audited when you see it.

• Check the scope and date. An audit covers named contracts at a specific commit. Code shipped or upgraded afterward is unreviewed, and the danger window stays open long after the badge is issued.
• Ask who holds the keys. Most 2026 megahacks were key, signing, or admin-permission failures. A contract audit does not test an exchange’s back end or a team’s key management.
• Look past the contract to the dependencies. Oracles, bridges, and third-party services sit outside most audit scopes and are exactly where attackers now concentrate.
• Treat a score as continuous, not final. A monitoring score like Skynet can move; a one-time certificate cannot. Prefer live signals over a frozen stamp.
• Remember who pays. The audited project chooses and pays the auditor, so read a badge as a paid opinion, not an independent guarantee.

Gu’s own framing is the honest one: an audit reduces risk at a single layer and a single moment. The failure is not that audits exist; it is that the market has been trained to treat a badge as a verdict rather than a receipt. The receipt is still worth having. It just does not cover the building.

Who Regulates the Auditors? Almost No One

Step back from CertiK specifically and a structural hole comes into view. In the United States, no financial regulator accredits, licenses, or supervises smart-contract auditors. The SEC does not certify them, the OCC does not examine them, and the Federal Reserve has no mandate over them. The word audited in crypto carries none of the legal weight it holds in, say, a financial statement signed by a licensed public accounting firm. It is a private opinion from a private company, sold to the party being reviewed.

That last part, the party being reviewed is the party paying, is the issuer-pays problem, and it has a famous precedent. Credit-rating agencies stamped AAA on subprime mortgage bonds in the 2000s partly because the issuers of those bonds chose and paid the raters. After 2008, the response was oversight: the SEC’s Office of Credit Ratings now supervises nationally recognized statistical rating organizations, with rules on conflicts and disclosure. Crypto auditors occupy the same structural position, the paid gatekeeper, with none of the supervision. There is no Office of Audit Ratings, no registration regime, no required conflict disclosures.

Where regulation did arrive, it landed on money, not on code review. The GENIUS Act, signed in July 2025, built a federal framework for payment stablecoins, which is precisely why Circle and Tether had both the ability and, increasingly, the expectation to freeze billions in stolen funds during the Binance heist. The compliant, centralized layer could claw back; the audited, decentralized layer could not. This is also why the accountability question keeps circling back to governance rather than to code. When an audited protocol or a decentralized organization fails, it is rarely clear who is on the hook, and an audit badge does nothing to answer it.

The Hacks Did Not Stop in November

If anyone hoped the record would buy a quiet start to November, it did not. On 4 November, CertiK’s monitoring arm flagged an attack on CoreVault, a protocol on the BNB Smart Chain. The attacker took out a flash loan, used it to manipulate the price feed CoreVault relied on, and inflated a redemption by roughly 33 times, draining the project’s insurance pool for a profit of about 160 BNB, or roughly $112,000. By the scale of October it is a rounding error. By the logic of this article it is the thesis in miniature: the contract did more or less what it was written to do, and the loss came from the economics and the oracle around it, not from a bug a reviewer would have flagged.

CoreVault is also a reminder of what CertiK actually does day to day, which is watch. Its Skynet alerts and on-chain tracing flag exploits in progress and follow the money afterward, work that is genuinely valuable and entirely separate from whether anyone was audited. The firm has leaned into automation here too, rolling out an AI Auditor earlier in the year that it says caught a high share of real-world incidents in testing, plus an AI tool for scanning the behavior of autonomous agents before they are deployed. Whether machine review closes the gap or merely speeds up the same point-in-time inspection is one of the open questions heading into 2027.

What to Watch Next

Three things will shape how this record ages. The first is recovery. Of the roughly $6.3 billion taken from Binance, around $2.7 billion was frozen within hours, but the attacker still controls billions, and North Korean laundering through mixers, cross-chain bridges, and over-the-counter brokers is patient and effective. How much comes back will decide whether 2026’s net figure, already roughly $5.7 billion by CertiK’s adjusted count, settles far below the gross headline or close to it.

The second is whether the industry finally moves its money to match its risk. If the lesson of a $9.2 billion year is that keys, signing systems, and operational resilience are where the damage happens, then budgets should flow there, toward hardware-backed signing, better multisig hygiene, insurance, and continuous monitoring, and away from the reflex of buying one audit and framing the certificate. CertiK’s pivot to a trust layer is a bet that they will. The third is CertiK itself. A firm that wants to be the first publicly listed Web3 security company, while counting the losses of its own backer and expanding into the very infrastructure it rates, is carrying a lot of narrative weight into 2027.

The through-line is simple and a little bleak. Crypto got much better at writing safe contracts and no better at protecting the humans and systems around them. Until that second number improves, the audit badge will keep meaning less than the market wants it to mean, and CertiK’s ledger will keep setting records nobody is proud of.

Frequently Asked Questions

How much did crypto lose to hacks in 2026?

By CertiK’s count, about $9.2 billion, the worst year on record and nearly three times the roughly $3.35 billion lost in 2025. A single event, the $6.3 billion Binance hack on 29 October, drove the total, and October alone saw about $6.5 billion in gross losses before roughly $3 billion was frozen or returned.

Did CertiK audit Binance before the hack?

No. CertiK is the source of the loss data through its Hack3d reports, not Binance’s auditor. The breach was a compromise of Binance’s signing infrastructure, not a flaw in reviewed smart-contract code, which is why CertiK classified it under wallet compromise rather than a code vulnerability.

What is the audit paradox in crypto security?

It is the gap between what audits check and where losses actually occur. Audits review smart-contract code, but in 2026 the overwhelming majority of stolen funds came from keys, signing systems, and operational failures. Of the five largest losses of the year, only the Liquid Network hack was a genuine code bug.

Can you trust a project just because CertiK audited it?

Not on its own. CertiK is a credible firm with roots in formal verification, but an audit is a scoped, point-in-time opinion paid for by the project, not a guarantee of safety. CertiK has also faced controversies, including the 2024 Kraken dispute and its audit of a stablecoin linked to the Huione marketplace.

Does a smart-contract audit prevent hacks?

It reduces the risk of specific, well-understood code bugs, which is valuable but narrow. An audit does not cover an exchange’s back end, a team’s private keys, third-party oracles, cross-chain bridges, or governance controls, and those layers are where most of 2026’s money was lost.

By Anneke de Vries, security desk, HOGE Wire.