Do Crypto Post-Mortems Actually Work? Ten Years, Same Bugs

In August 2013, the Bitcoin project published an emergency alert: a flaw in Android’s random-number generator had let several popular wallet apps sign transactions with repeated values, handing anyone who noticed the keys to the funds. The fix was simple and brutal, generate a fresh address on repaired software and move everything. Thirteen years later, in the summer of 2026, thieves drained more than $130 million in Bitcoin from Coinkite’s Coldcard hardware wallets after a 2021 firmware change quietly downgraded the device to a weak software generator, producing keys an attacker could guess. Different hardware, different decade, the same failure: not enough randomness.

Crypto is unusually good at writing down what went wrong. No other corner of finance produces this volume of public autopsies: minute-by-minute timelines, annotated transaction hashes, root-cause threads, and the grim leaderboards that keep score. The genre has a decade of history now, dating to The DAO reentrancy hack of 2016. So it is fair to ask a blunt question. Does any of it work? If the industry dissects every disaster in public, why does the summer of 2026 read so much like 2022, and 2020, and 2016?

The honest answer is neither triumphant nor nihilistic. A decade of post-mortems genuinely cured some diseases; reentrancy, the bug that nearly killed Ethereum in its infancy, has fallen down the industry’s own threat rankings because tooling and patterns finally caught up. But each cure pushed attackers toward the surfaces the autopsy captures worst: stolen keys, compromised infrastructure, social engineering, and laundering rails that erase the trail entirely. The learning is real. It just covers the part that is easy to write up.

The Most Honest Thing Crypto Does

The crypto post-mortem did not appear from nowhere. Its structure was borrowed almost wholesale from software reliability engineering, specifically the blameless post-mortem culture that Google codified in its widely read Site Reliability Engineering book, which treats an outage as a system failure to be documented rather than a person to be punished (sre.google). Root cause, timeline, contributing factors, action items: the skeleton is identical.

What crypto added was an audience. A traditional reliability post-mortem is an internal document. A crypto post-mortem is a public performance, because the funds are gone from public view and the victims are scattered strangers with no customer-service line to call. The pseudonymous site rekt.news turned the form into noir literature, complete with a running leaderboard of the largest losses that works as the industry’s collective memory and hall of shame. Forensic firms publish teardowns within hours. Founders livestream their own worst days.

There is a reason the confession is so public. For a centralized exchange, a hacked customer at least has a regulator to complain to. For a decentralized protocol, there is often no company, no deposit insurance, and no court that will move fast enough to matter. The post-mortem, the on-chain negotiation with the attacker, the DAO vote to reimburse: these rituals substitute for the legal recourse that does not exist. When crypto people say the post-mortem is the most honest thing the industry does, they mean it is frequently the only thing on offer.

The Optimistic Case: Reentrancy Got Cured

Start with the good news, because there is some. The clearest evidence that the autopsy culture works is buried in the industry’s own annual threat ranking. The OWASP Smart Contract Top 10 for 2026, compiled from 122 deduplicated on-chain incidents representing roughly $905 million in 2025 losses, lists access-control failures at number one, business-logic flaws at two, and price-oracle manipulation at three. Reentrancy, the exact bug class that drained The DAO in June 2016 and forced the hard fork that split Ethereum from Ethereum Classic, now sits at number eight, down from fifth a year earlier.

That decline is not luck. Reentrancy is the most-studied bug in the space precisely because it almost killed Ethereum before it was two years old. A decade of post-mortems produced a decade of countermeasures: the checks-effects-interactions pattern became doctrine, OpenZeppelin’s ReentrancyGuard became a near-default import, and static analyzers like Slither and Mythril flag the pattern automatically before code ships. When a class of failure is reproducible, has a clean on-chain signature, and can be caught by a linter, the post-mortem corpus compounds into real defense. Write it up enough times and the tooling absorbs the lesson.

This is the model that works, and it is worth naming precisely, because it explains what the culture can and cannot fix. Bugs that live entirely in the contract, that can be reproduced from public data, and that a machine can learn to detect: those get cured. The trouble is that attackers do not keep fighting on ground where the defender has learned to win.

The Same Bug, Years Apart

For everything the corpus cured, an uncomfortable amount recurs. Dan Guido, co-founder of the audit firm Trail of Bits, once summed up the entire aspiration of the field in a single line: “I never want to find the same bug twice.” The record of 2025 and 2026 suggests the industry finds the same bug constantly, often years after a public write-up spelled out exactly how to avoid it.

Consider rounding and precision errors, the arithmetic category that OWASP now ranks seventh. In November 2025, Balancer lost roughly $129 million to an access-control flaw that enabled exploitation of a rounding bug in its Composable Stable Pools. Trail of Bits had flagged the underlying risk back in 2021, filed as TOB-BALANCER-004, and later published a rare public retrospective owning the miss (blog.trailofbits.com). Two months earlier, in September 2025, Bunni was drained of about $8.4 million through a rounding edge case its auditors had gestured at as TOB-BUNNI-13; the patch did not cover the exact sequence an attacker eventually used, and the team shut down for good (The Block).

The GMX case is almost poetic: the reentrancy bug that drained about $42 million in July 2025 lived inside a 2022 patch that had itself fixed an earlier bug, and that patch was never independently re-audited (CoinDesk). Cetus, the Sui DEX drained of roughly $223 million in May 2025, fell to a botched overflow check inside a third-party math library, the kind of bug the industry has understood since before Ethereum existed (The Block). And the Coldcard drain that opened this piece is the sharpest recurrence of all, a weak-randomness failure the Bitcoin project had publicly alerted on in 2013, repeating almost note for note thirteen years later (TechCrunch; Coinkite’s technical backgrounder).

Audited, Then Drained

If post-mortems taught the industry anything, it should be that an audit is a snapshot, not a warranty. Yet the reflex to treat “audited by X” as a safety guarantee persists, and the 2026 record punishes it. Balancer’s vault had been reviewed multiple times by multiple firms before it lost nine figures. Suhail Kakar, a developer-relations lead at TAC Blockchain, put the lesson bluntly after that hack: “Balancer went through 10+ audits. The vault was audited three separate times by different firms still got hacked for $110M. This space needs to accept that ‘audited by X’ means almost nothing. Code is hard, DeFi is harder.”

The deeper problem the post-mortems keep circling but never resolve is accountability. When a bridge or a lending market is drained, the write-up names a root cause, but no regulator anywhere accredits the auditors whose report missed it. There is no PCAOB for smart contracts, no licensing board, no malpractice standard. An audit report is a best-effort opinion wrapped in disclaimers, and when the code fails the auditor keeps operating while the protocol frequently does not. Bunni died; its auditors did not. That asymmetry is the quiet scandal at the center of the culture: the document that reads like an accountability ritual usually holds no one accountable at all.

There is a market reason the badge persists. A clean audit is a marketing asset that pulls in deposits, and deeper liquidity is precisely what makes a protocol worth attacking, so the report meant to reduce risk can quietly raise the payoff for breaking it. The auditors themselves rarely claim otherwise; their reports are studded with language noting that a review covers a specific commit on a specific date and guarantees nothing about code shipped later. The post-mortem, arriving after the loss, is where that fine print finally gets read out loud. It names the audit, notes what the audit covered, and moves on, because there is nowhere else for the accountability to land.

The Money Moved to Where the Autopsy Can’t Reach

Here is the pivot that reframes the whole question. While the industry got better at catching code bugs, the money quietly relocated to the failures that leave no clean on-chain trace. TRM Labs, tracking the first half of 2026, counted a record 207 hacks that stole about $972 million, down more than half from H1 2025’s $2.3 billion even as the number of incidents more than doubled (TRM Labs). The telling split sits inside those numbers. Smart-contract exploits made up 125 of the 207 incidents, the clear majority by count, yet a small share of the dollars. Infrastructure, key, and operational compromises were about 15 percent of incidents but roughly 76 percent of the value stolen.

CertiK’s parallel tally of H1 2026 reaches a different total, $1.315 billion across 344 incidents, but lands on the same shape: code bugs were the most frequent category at 204 incidents yet the least lucrative at $151.6 million, while wallet compromise was the costliest vector at more than $444 million across just 33 incidents, over $13 million each (Forbes). CertiK chief executive Ronghui Gu described the migration precisely: “Attackers are getting more return by going after key management, multisig governance, and operational infrastructure than by hunting for bugs in code.”

This is the surface the post-mortem is worst at examining. A reentrancy exploit reproduces from public data; anyone can replay it in a fork and understand it completely. A stolen signing key or a spear-phished engineer leaves almost nothing on-chain except a series of perfectly valid transactions. The two largest heists of 2026, the roughly $292 million KelpDAO drain and the $285 million Drift breach, were not contract bugs at all; both traced to compromised infrastructure and social engineering. Bridges have become the archetype of this pattern, which is why the trust model behind them, not their Solidity, is where the real risk lives (see our explainer on how cross-chain trust actually works). The autopsy can confirm the money left. It often cannot show you the moment a human was fooled.

Three Reports, Three Totals

There is a second, subtler problem, and it undermines the premise that the corpus accumulates into shared knowledge at all: crypto cannot agree on what it lost. Ask three respected security firms how much was stolen in the first half of 2026 and you get three materially different answers.

The gap between TRM’s $972 million and CertiK’s $1.315 billion is not a rounding error; it is more than a third of the smaller figure, and it comes from different definitions of what counts as an incident and which losses belong to which half of the year. SlowMist, counting 182 events for about $956 million, draws the line in yet a third place (CryptoRank). The same KelpDAO loss even lands under different headings: infrastructure compromise for TRM, a supply-chain attack for SlowMist.

What is striking is that the three firms disagree on the number while converging on the trend. All of them report that incident counts rose sharply as dollar losses fell, and all of them describe the same drift from code to people. SlowMist framed its own half by noting that Web3 attack targets are moving from code to people, with nearly 90 percent of stolen funds now effectively irrecoverable (Odaily). That is the paradox of the archive: it can see the direction clearly and still cannot produce a single agreed number, because there is no shared registry that everyone files to. Every firm keeps its own books.

When the Trail Goes Cold

The clearest recent illustration of the autopsy’s limits is only days old. On August 9, 2026, the crypto payments platform Coinsbuy had wallets drained of more than $7.9 million across Ethereum and Tron in a single coordinated sweep around 13:00 UTC. The on-chain investigator known as Specter Analyst flagged the movement almost immediately, Coinsbuy paused deposits and withdrawals, and the exchange ChangeNOW froze a six-figure sum linked to the funds (Crypto Times). Everything the post-mortem playbook prescribes happened, and quickly.

It did not matter much. The attacker moved the proceeds into Monero, the privacy coin engineered to break transaction graphs, before the bulk could be traced or frozen (Crypto Briefing). Once value crosses into a well-designed privacy chain, the forensic trail that the entire genre depends on simply ends. You can write a flawless timeline up to the swap and a blank page after it.

That is the frontier the culture has not solved, and arguably cannot. The post-mortem is a product of a transparent ledger; it works because on public chains everything is visible forever. Strip the visibility, whether through a mixer, a privacy coin, or a chain built to forget, and the autopsy loses its subject. Laundering has quietly become the single most important variable in whether a hack is recoverable, and it is precisely the variable a transaction-graph autopsy is least equipped to follow.

What Crypto Borrowed From Aviation, and What It Left Behind

Crypto took the literary form of the post-mortem from software engineering, but there is an older model it admired and never actually copied: aviation. When an aircraft goes down, an independent public authority investigates, and the findings land in a permanent, searchable, mandatory registry that every operator can learn from. The National Transportation Safety Board’s accident database is the reason a crash in one airline’s fleet becomes safety knowledge for all of them. The report is not optional, and it is not the airline’s to spin.

Crypto imported the blameless write-up and skipped the registry. There is no central authority that every hacked protocol must file to, no standardized report format, no evidentiary bar for attribution. In the European Union, the closest thing to a mandatory clock is the Digital Operational Resilience Act, which requires regulated crypto-asset service providers to file an initial incident notification within hours and a full report within a month (EIOPA). But DORA covers licensed intermediaries, not autonomous DeFi protocols, and its reports flow to regulators, not to the public. The part of the aviation model that makes knowledge cumulative, the open central archive, is exactly the part crypto left on the table. What it has instead is a scattering of brilliant individual autopsies with no shared shelf to put them on.

Aviation also collects the failures that did not happen. Its confidential near-miss reporting systems let a pilot flag a close call without punishment, so the industry learns from incidents that hurt no one. Crypto has almost no equivalent. The attacks that whitehats intercept, the exploits a monitoring bot front-runs, the bugs quietly patched before anyone notices: most of these never get written up, because there is no loss to explain and little incentive to advertise the near-miss. The published corpus is therefore skewed toward completed disasters, which means the worst outcomes are over-represented while the saves that would teach defenders the most stay largely invisible.

An Archive That Isn’t Yet a System

That does not mean the record is worthless. Over a decade, crypto has built an impressive set of institutions for remembering its failures. They are simply not connected to one another.

Each of these is genuinely useful, and together they cover narrative, data, taxonomy, and response. What they do not form is a system. rekt.news remembers the story; SlowMist and DefiLlama remember the data on incompatible schemas; OWASP catalogs the code bugs but by design says nothing about stolen keys or fooled employees, which is where most of the money now goes. The Security Alliance’s Safe Harbor framework standardizes how a whitehat can return funds without legal jeopardy, a real advance, but it addresses the aftermath, not the cause. The pieces of a cumulative safety science are all present. Nobody has assembled them into one.

The Regulator’s Blind Spot

If the industry will not build a shared registry, the obvious question is whether a regulator will force one. The 2026 answer, in both the United States and Europe, is no, at least not for the failures that now dominate the losses.

In March 2026, the SEC issued its first formal classification of crypto assets, with Chairman Paul Atkins declaring that most crypto assets are not themselves securities and sorting tokens into a five-part taxonomy (SEC). It is a landmark, but it is a document about what a token is, not about how securely it was built; nothing in it sets a code-audit standard, mandates an incident registry, or licenses the auditors whose misses the post-mortems keep documenting. The agency’s enforcement machinery, which we have mapped separately in our field guide to SEC crypto enforcement, targets classification and fraud, not engineering practice.

Europe’s MiCA regime reaches further into conduct, but it governs centralized service providers, not the decentralized protocols where DeFi victims have no complaint window at all. The regulatory perimeter, in other words, is drawn around who holds your money and what your token is called, not around whether the code or the keys were sound. For the entire category of failure that TRM and CertiK say now accounts for roughly three-quarters of the value stolen, stolen keys and compromised infrastructure, there is no regulator writing the rules and no mandatory report. The post-mortem remains the only accountability document, and it is written by the party with the most to lose from writing it honestly.

The AI Turn: A Compounding Corpus, or a Faster Adversary?

The most consequential change to this picture is not regulatory; it is that both defenders and attackers now have machines reading the code. The Coldcard disaster is the case study. Coinkite founder Rodolfo Novak argued that AI-assisted review is what surfaced the five-year-old entropy bug in the first place, warning that “AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts.” If your firmware has ever been public, he added, assume it is already being read by attackers and defenders alike.

For the defense, this is the first mechanism that could genuinely make the post-mortem corpus compound. Trail of Bits, describing its own shift to AI-native review, reported moving from a handful of findings a week to hundreds as models learned to pattern-match against the historical record of bugs (Trail of Bits). A machine that has ingested every published autopsy is exactly the compounding memory the human archive never became. That is the optimistic reading: the same corpus that failed to prevent recurrence by hand might finally do so at machine scale.

The pessimistic reading is that the tool is symmetric. The same models that help auditors read faster help attackers read faster, and the old asymmetry, that finding a bug was hard, erodes for both sides at once. This is where a parallel research frontier matters: efforts to make computation itself verifiable, so a system can prove it ran the code it claimed to rather than trusting an operator’s word. Our look at whether zero-knowledge proofs can scale to real AI traces one version of that bet. Whether AI ends up making crypto safer or merely faster is, at the moment, genuinely undecided.

What the Post-Mortem Can and Can’t Buy

So does the post-mortem culture work? The evidence supports a narrow yes and a broad no. For failures that live in the contract, that reproduce from public data, and that a linter or a model can learn to catch, the culture delivers real, cumulative medicine; reentrancy’s slide down the rankings is the proof. For everything else, stolen keys, fooled humans, unaudited patches, laundering into privacy chains, the post-mortem is folk memory, a well-told story that rarely prevents the next telling.

That distinction also explains why some protocols walk away from a catastrophic hack and others vanish, a question we examined in detail in our study of which hacked protocols survive and which die. Survival turns less on the quality of the autopsy than on capital, communication speed, and whether the flaw was isolated or fundamental. A perfect post-mortem does not refill a treasury or un-fool an engineer. It documents, and documentation is necessary but not sufficient.

The uncomfortable implication for anyone holding crypto is that the industry’s most impressive habit, its compulsive public honesty about failure, is strongest exactly where the risk is now smallest, and weakest exactly where the money now goes. That is not an argument against post-mortems. It is an argument for reading them with a clear eye about what they can actually buy you.

How to Read a Post-Mortem in 2026

Because the document is so often the only recourse, it is worth knowing how to grade one. A decade of examples has produced a rough rubric, and the gap between a serious autopsy and a public-relations exercise is usually visible within the first few paragraphs. A credible post-mortem tends to share certain traits:

• A minute-level timeline anchored to on-chain evidence, not a vague reference to a security incident.
• A specific, reproducible root cause named down to the function or the failed assumption, rather than an unattributed sophisticated attack.
• A clear loss accounting that separates funds drained from funds recovered or frozen, and that is updated as the picture changes.
• An explicit statement of who absorbs the loss, and whether users are made whole.
• A concrete remediation with a code fix and, ideally, an independent re-audit of that fix.

The warning signs are the mirror image. A protocol that hides behind passive language (funds were affected rather than we lost X), that reaches for a North Korea attribution before any evidence supports it, that never publishes a root cause, or that settles on the phrase comprehensive inspection and goes silent, is usually managing a narrative rather than explaining a failure. The most revealing question to ask of any post-mortem is who is the grammatical subject of each sentence. A write-up that keeps the user or the market in the subject position (the user accepted the warning) is doing something different from one that says our system failed to reject an impossible trade. Both can be technically accurate. Only one is an accountability document.

None of this is exotic. It is the same reading discipline you would bring to a mining company’s cost disclosures or an analyst’s price target: work out what the author is incentivized to emphasize, then read for what they are incentivized to bury. In a market where the autopsy substitutes for the courtroom, that skill is not optional. The post-mortem is one of the genuinely good things crypto invented. It is also, on the numbers, aimed at the wrong half of the battlefield.

Frequently Asked Questions

What is a crypto exploit post-mortem?

A crypto exploit post-mortem is a public report, usually from the hacked protocol or an independent forensic firm, that reconstructs how an attack happened. It typically includes an on-chain timeline, a technical root cause, an accounting of funds lost and recovered, and the planned fix. The format is adapted from the blameless post-mortems of software reliability engineering, but crypto publishes it openly because affected users often have no other channel for answers.

Does crypto’s post-mortem culture actually make the industry safer?

Partly. Bug classes that live in the contract and reproduce from public data, such as reentrancy, have measurably declined; reentrancy fell to eighth on the 2026 OWASP Smart Contract Top 10 from fifth a year earlier. But the failures that now cause most losses, stolen keys, compromised infrastructure and social engineering, leave little on-chain trace and are far harder for a post-mortem to prevent. The culture cures what it can reproduce and struggles with everything else.

Why do the same crypto bugs keep happening after they are documented?

A public write-up only helps if the fix and the tooling reach every team, and much of the industry ships fast on forked or lightly reviewed code. Attackers also move to new surfaces once an old one is well defended, so the money shifts from contract bugs to keys and people. The 2026 Coldcard weak-randomness drain, which echoed a 2013 Android wallet flaw, shows how a lesson can be public for years and still be repeated.

How much was stolen in crypto hacks in the first half of 2026?

Estimates vary because there is no shared registry. TRM Labs counted about $972 million across 207 incidents, CertiK reported roughly $1.315 billion across 344 incidents, and SlowMist logged about $956 million across 182 events. All three agree that incident counts rose sharply while total dollars fell by more than half from H1 2025, and all three describe a shift from code exploits to key and infrastructure compromise.

How can I tell a good post-mortem from a bad one?

Look for a specific, reproducible root cause named down to the function, a timeline tied to on-chain evidence, a transparent loss-and-recovery accounting, a clear statement of who covers the loss, and a code fix with an independent re-audit. Treat vague passive language, a rushed attribution before evidence supports it, or a retreat into a phrase like comprehensive inspection with no root cause as red flags for narrative management rather than genuine disclosure.

Anneke de Vries is a senior editor at HOGE Wire covering security, exploits, and the aftermath of crypto’s public failures.