Strategy (MSTR), the world’s largest corporate bitcoin BTC$64,610.26 holder, raised its cash reserve by roughly $225 million last week after selling common stock, bolstering liquidity while leaving its bitcoin holdings unchanged.

Michael Saylor, executive chairman of the firm, said Monday that Strategy now holds a U.S. dollar reserve of $3.225 billion alongside its 843,775 BTC stash.

A regulatory filing showed the company sold over 2.7 million MSTR shares for roughly $263.5 million through its at-the-market equity program.

MSTR was 1.2% higher at $96 in pre-market trading alongside a small rise in the price of bitcoin over the weekend to the current $64,700.

The latest update comes as Strategy has focused on rebuilding its cash buffer after its increasingly complex financing model and dividend-paying preferred stock structure came under pressure during the recent crypto market downturn.

Earlier this month, the company disclosed the sale of about $216 million worth of bitcoin, a rare reduction in its BTC holdings that marked its first significant sale after years of near-continuous accumulation. Before that, the firm approved a new bitcoin monetization program that included selling up to $1.25 billion of its BTC stash for cash reserves and dividend payments.

Strategy remains the world’s largest corporate bitcoin holder by a wide margin. At bitcoin’s current price of $64,700, its 843,775 BTC treasury is worth nearly $55 billion.

Institutional investors are widening crypto security checks beyond smart contract audits as operational failures become a larger source of losses. 

Hacken’s Q2 2026 Security & Compliance Report said traditional trust markers, including previous audits and operating history, did not reliably show which projects would avoid an exploit.

The report tracked 1,427 projects and found that only 9% showed evidence of third-party monitoring. Just 4% combined monitoring with an active bug bounty and an audit. Hacken said compromised keys, signers and infrastructure accounted for 88.3% of about $764 million stolen during the quarter, shifting attention toward controls that remain active after code reviews.

Hacken said institutions are asking whether security controls match the capital a protocol holds. Federico Bagiotti, group head of risk management at Abraxas Capital, said “inadequate security relative to the capital at risk” was the issue most likely to make the firm reject an otherwise attractive position.

Institutional reviews increasingly cover signer-set changes, collateral backing, outside service providers and incident-response plans. Abraxas also checks for timelocks, withdrawal-address whitelisting, multiparty controls and reliance on a single key or verifier. These measures focus on privileged access and emergency readiness rather than only whether contracts passed a review.

A separate H1 2026 report from CertiK also found that lower headline losses did not mean crypto had become safer. As crypto.news reported, crypto-related losses fell 46.8% year over year to $1.32 billion in the first half, but wallet compromises became the largest attack method in Q2. CertiK put Q2 losses from that category at $807.5 million under its own methodology.

Audited crypto projects still failed outside contract code

Hacken identified 14 projects exploited during Q2 that had previously completed audits. In many cases, the failure occurred outside the smart contract code covered by a conventional review. The affected areas included signer devices, bridge validators, backend systems, administrator keys and older contracts that remained active after teams stopped using them.

As crypto.news reported in June, Humanity Protocol lost about $36 million after malware on a developer device exposed seven private keys. Investigators said the attacker used valid credentials to authorize transactions, while the project’s smart contracts and Safe architecture were not themselves exploited.

A similar pattern appeared in two of the year’s largest reported attacks. Crypto.news previously reported that the Drift Protocol and KelpDAO incidents relied on social engineering, compromised devices and bridge infrastructure rather than direct smart contract flaws. Together, those attacks accounted for $577 million in losses.

Institutions demand continuous crypto security evidence

Rajeev Bamra, head of digital economy strategy at Moody’s Ratings, said operational resilience had become “the practical lens” through which institutions assess security, compliance and governance. Under that approach, an audit remains part of the review, but investors also seek evidence that teams monitor access and prepare for failures after deployment.

Institutional custody reviews are moving in the same direction. As crypto.news reported on July 11, European regulators launched a review of MiCA-authorized crypto custodians focused on private-key management, transaction controls, incident response and third-party technology risks. BitGo Chief Operating Officer Jody Mettler said institutional clients increasingly ask how custodians segregate assets, control access and maintain services during market stress.

Hacken’s dataset covered projects with market capitalizations above $1 million listed across the top 50 centralized exchanges by CoinGecko Trust Score. It excluded stablecoins, wrapped assets and tokenized real-world assets. The research relied on publicly visible or disclosed controls, so private security arrangements may not appear in the data.

Monitoring and incident readiness become allocation tests

The move toward continuous checks does not remove the role of smart contract audits. Hacken’s Q1 2026 report recorded six exploited protocols that had been audited, including one with 18 previous audits. The firm said security needs to cover code, operations and infrastructure throughout a project’s life rather than end when an audit report is published.

For investors, that wider review can include real-time monitoring, bug bounty programs, key-management design, signer separation and tested response plans. Projects that cannot show those controls may face more questions from allocators, insurers and counterparties before receiving capital or commercial access, according to Hacken’s Q2 findings.

Recent regulatory and security data follows the same pattern. ESMA is testing the operational resilience of licensed custodians, while CertiK found that targeted wallet compromises drove a large share of 2026 losses. For institutions assessing crypto exposure, the question is increasingly not only whether a project was audited, but whether its controls keep working afterward.

Brazil’s securities regulator, the Comissão de Valores Mobiliários (CVM) said it created a working group to draft an experimental framework for tokenized securities.

The regulator said the framework will cover the registration, custody, trading and settlement of securities using distributed ledger technology.

The group must send its first proposal to the CVM’s board within 60 days of being formally installed, while a broader review will run for 120 days, with a possible 30-day extension.

The group brings together 14 CVM departments and may consult government agencies, market associations, self-regulatory bodies and outside specialists. It will also review cybersecurity risks, international regulatory models and results from earlier sandbox programs, the regulator said.

Brazil already applies securities law according to a token’s economic characteristics. The CVM’s 2022 guidance clarified that using blockchain does not change whether an asset qualifies as a security.

The new review will focus on what happens around the asset.

Blockchains can combine functions that are normally split between exchanges, custodians, registrars, depositories and settlement systems. That raises questions over who controls the official ownership record, how private keys are held, when transactions can be reversed and who is liable when systems fail.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

After years of relying on smart contract audits as a key “trust signal,” institutional investors are increasingly treating operational security as the real gatekeeper for allocating capital to crypto projects. Hacken’s Q2 2026 Security & Compliance Report argues that conventional review artifacts—such as third-party audits and a project’s operating history—have not consistently correlated with which systems end up being exploited.

In the quarter, Hacken tracked 1,427 crypto projects (with market caps above $1 million) and found that only a small fraction had meaningful layers of ongoing monitoring. At the same time, it attributes the majority of losses to compromise scenarios that traditional contract-level audits typically don’t cover, including keys, signers, and surrounding infrastructure. For risk teams, the takeaway is clear: due diligence is moving beyond code review toward evidence that controls are actively maintained and resilient.

Key takeaways

• Hacken reports just 9% of 1,427 tracked projects had third-party monitoring, and only 4% combined monitoring with both a bug bounty and a security audit.
• Across the quarter’s reported thefts of roughly $764 million, Hacken attributes 88.3% of losses to compromised keys, signers, and infrastructure.
• Operational security reviews are expanding to include signer-set changes, collateral backing, third-party dependencies, and incident-response readiness.
• Hacken says projects that cannot show ongoing evidence of operational security may face higher perceived risk, less investment interest, and harder access to insurance or counterparties.

Why audits are no longer enough

Hacken’s central argument is that the audit-centric approach doesn’t reliably predict whether a project will be exploited. According to the report, institutional confidence signals such as prior audits and operational history have not offered consistent protection against real-world compromise.

The report’s data helps explain why. Hacken notes that while 14 of the projects exploited in Q2 had previously undergone audits, the losses mostly came from attack surfaces beyond the typical scope of smart contract review. Those surfaces included signer devices, bridge validator components, backend infrastructure, admin keys, and “older” contracts that remained active even after being deprecated.

That distinction matters for investors because it reframes what “secure” means. An audited contract can still be vulnerable if the surrounding operational controls—key management, signing processes, administrative access, and supporting infrastructure—are weak, stale, or insufficiently monitored.

The monitoring gap highlights a control reality

Hacken’s review of 1,427 projects (based on assets listed across the top 50 centralized exchanges by CoinGecko Trust Score) is designed to capture observable and disclosed control setups. The methodology matters: Hacken’s dataset excludes wrapped assets, stablecoins, and tokenized real-world assets, and it relies on publicly observable arrangements—meaning private measures may not show up in the analysis.

Even with that limitation, the numbers point to a broad monitoring gap. Only 9% of tracked projects had third-party monitoring, and just 4% combined monitoring with an active bug bounty and a security audit. In practice, this suggests that most projects may lack layered external scrutiny that can detect or deter issues before attackers exploit weaknesses.

Hacken also flags a structural consequence for capital access: when projects cannot provide continuing evidence that security controls remain effective over time, they may be priced as higher risk. That can ripple outward into fewer investment opportunities and more difficult negotiations with counterparties and insurers.

Operational resilience reshapes due diligence

Hacken says institutional due diligence is broadening in ways that extend past contract correctness. Its report describes a shift toward checking not just “what was audited,” but how the system operates day to day.

Among the areas now being incorporated are signer-set changes, collateral backing, third-party dependencies, incident-response readiness, and the scope and recency of audits. The emphasis on recency is particularly relevant: even a strong audit from the past may not reflect changes in infrastructure, control policies, governance, or integration dependencies.

One investor risk example comes from Abraxas Capital. In the report, Federico Bagiotti, group head of risk management at Abraxas Capital, is cited saying that “inadequate security relative to the capital at risk” was the factor that most often drove the firm to reject positions. The operational controls Abraxas reportedly screens for include timelocks, withdrawal-address whitelisting, multiparty controls, and avoiding reliance on a single key or single verifier.

Moody’s Ratings’ perspective adds another layer: Rajeev Bamra, head of digital economy strategy at Moody’s Ratings, is quoted in the report stating that operational resilience has become “the practical lens” institutions use to evaluate security, compliance, and governance. Taken together, these views suggest investors are trying to reduce uncertainty by focusing on how failures are prevented—or contained—rather than trusting a static snapshot of code review.

Regulators are also pushing the conversation toward resilience

The report’s narrative aligns with wider scrutiny of operational robustness in the custody and compliance stack. In a July 10 Cointelegraph report, BitGo Chief Operating Officer Jody Mettler said institutional clients had started asking more detailed questions about custody providers’ access controls, incident response, and business continuity, as European regulators examined operational resilience under the Digital Operational Resilience Act (DORA).

That regulatory pressure helps explain why audits alone are losing their predictive value. Key management, signing access, operational continuity, and incident workflows are not merely “best practices”—they are increasingly part of what regulators and risk committees expect to see operationalized.

Hacken’s findings reinforce that point. With 88.3% of the roughly $764 million stolen in Q2 traced to compromised keys, signers, and infrastructure, the industry’s focus on resilience moves closer to the areas where losses actually originate.

What readers should watch next

The next test for projects and investors will be whether security programs evolve from periodic audits into verifiable, continuously maintained controls—especially around signing authority, key custody, administrative access, and incident readiness. Hacken’s Q2 findings suggest that diligence will increasingly reward ongoing evidence, not just historical certifications, so investors should watch how quickly teams improve monitoring coverage and tighten operational guardrails as systems and dependencies change.

In one week, Bitcoin sat still through missile strikes in the Strait of Hormuz and then fell with Asian chip stocks. The war test and the tech test gave opposite answers about what Bitcoin is, and both answers are correct. Working out how is the most useful thing a holder can do right now.

Two tests were administered to Bitcoin this month, days apart, by events nobody scheduled. The first was a war test: American strikes on Iran, then Iranian missiles fired at commercial ships in the Strait of Hormuz, ending a week-long lull. Oil jumped, gold firmed, Treasuries caught a safety bid, and Bitcoin did something it has almost never done in its history. Nothing. It held a tight range through a weekend of exactly the headlines that once triggered instant three-percent drops.

The second was a tech test: a rout in AI and chip stocks that produced the Nikkei’s worst session since March and a 500-point Nasdaq slide. This time Bitcoin moved immediately, straight down, below $63,000, while gold rose back above $4,000 in the same session. One asset, two shocks, two opposite responses, one week. Either Bitcoin has matured past panic or it has been absorbed into the tech trade, and the strange truth is that both readings are right, because they are answers to different questions.

The week that ran the experiment

The facts first, because the sequencing is the argument.

The war leg came first. Following US strikes on Iranian targets, Iran’s military fired at least two missiles at commercial ships transiting the Strait of Hormuz, ending a pause in attacks under a US-Iran understanding. Brent crude climbed toward $88 a barrel, up roughly 30% over two weeks, the classic supply-shock signature. Gold firmed. And Bitcoin held near $63,800 through the weekend and into the week, trading in a range so tight that market desks remarked on it. This is the asset that fell as much as 3% in hours when Israeli strikes on Iran first landed in 2025, an episode that liquidated over a billion dollars of leveraged longs in a day. The same category of headline now produced approximately no response. Whatever Bitcoin was in that earlier episode, it is not that now.

The tech leg followed. Concerns over stretched AI valuations, brewing for weeks, broke into a rout: heavy selling in Asian semiconductor names took the Nikkei down as much as 5% in its worst session since March, the Nasdaq shed more than 550 points at its lows, and a separate session saw SK Hynix plunge 12% in Seoul, dragging the Kospi down 7%. US index futures pointed lower, and the risk-off rotation ran the textbook route: the dollar index rose to around 100.75, and gold advanced 0.61% to reclaim $4,000. Bitcoin went with the chip stocks, not with the gold, sliding below $63,000, with ether falling harder, as much as 3% toward $1,830, in the usual pattern of a liquidity-driven selloff where the majors bleed and everything beneath them bleeds more. One strategist compressed the week into a phrase, describing a market bruised by “AI fatigue and Hormuz heat.”

Put the two legs side by side, and the discrimination is unmistakable. Bitcoin ignored the war variable and responded to the liquidity variable, in the same week, with the same holders, at the same price level. Markets rarely run experiments this clean.

The maturation reading

The first interpretation is the one Bitcoin’s advocates should be making carefully rather than triumphantly, because it is real but narrower than it sounds.

An asset that no longer panics on kinetic conflict headlines has, by definition, graduated from one class of behavior. The old pattern was mechanical: geopolitical shock, risk-off reflex, leveraged crypto longs liquidated first because crypto trades around the clock and its leverage is the most accessible to margin calls. During the 2025 Israel-Iran escalation, a derivatives executive described the dynamic plainly: in moments of acute military risk, liquidity gets prioritized over narrative, traders raise dollars and cut volatile exposure, and Bitcoin, being the most liquid volatile thing on earth, gets sold. That reflex appears to have weakened substantially. Holding a tight range through strikes, ship attacks, and a hawkish Fed repricing is not what a panic asset does.

Part of the change is structural and measurable. The marginal holder is different now: ETF vehicles, corporate treasuries, and long-horizon allocators sit where leveraged retail once dominated, and Strategy’s stack of 843,775 BTC did not move an inch through the week. Positioning data points the same way, with open interest growing only modestly and funding rates near flat, the signature of a market without a crowded leveraged side to flush. An unlevered holder base with multi-year horizons simply has no mechanism for transmitting a Hormuz headline into a forced sale, and the tape now reflects that.

There is also a subtler point the maturation camp is entitled to: not-reacting is what the digital gold thesis predicts for this specific shock. Gold itself did not spike dramatically on the missiles; it firmed. Hard-asset hedges are not supposed to convulse on war news, they are supposed to sit there being unconfiscatable while everything levered convulses around them. On the war leg alone, Bitcoin behaved more like gold than it ever has.

The tech-proxy reading

Then came the second leg, and the second reading, which the first cannot explain away.

When the AI rout hit, the hedge behaved like a hedge and Bitcoin behaved like a chip stock. Gold up, dollar up, Bitcoin down with the Nasdaq. If Bitcoin’s holders had truly rotated into the it-is-digital-gold consensus, the AI selloff was the moment to prove it, a valuation scare in the exact sector Bitcoin is supposedly a refuge from. Instead the correlation asserted itself immediately, and the explanation is uncomfortable for the maturation camp: the marginal dollar flowing into Bitcoin over the past two years is substantially the same dollar that has been chasing AI. Same risk budget, same momentum style, same sensitivity to the rate path. When that dollar gets scared, it sells both positions, because to its owner they were always the same trade, long technological transformation with leverage on liquidity.

The longer tape supports this reading brutally. Bitcoin sits roughly 50% below its October 2025 record near $126,200, and the path down has tracked the same rate fears, the same liquidity squeeze, and now the same AI-valuation jitters dragging the Nasdaq, with the whole crypto complex down roughly 48% from a $4.2 trillion peak. Nothing in that drawdown looks like an uncorrelated store of value; all of it looks like the high-beta end of a single global risk trade. Analysts working the flows have said so directly: Nansen’s Nicolai Sondergaard argued the tape reflects the inflation and liquidity channel doing the work, not the geopolitical hedge narrative, pointing to the soft June CPI print, 3.5% headline against 3.8% expected, that reset Fed expectations, sank the dollar to multi-month lows, and eased the 10-year toward 4.57% in mid-July. Bitcoin rallied on that print and fell on the AI rout, which is to say it traded monetary conditions twice and missed zero times.

On this reading, the calm during the war was not maturity. It was indifference of a specific kind: the asset’s owners no longer believe Middle East risk changes dollar liquidity much, so they do not trade it, exactly as the Nasdaq does not trade it. Bitcoin did not rise above the war. It joined the asset class that ignores wars until oil makes the Fed’s job harder.

The synthesis the week actually supports

Here is the resolution, and it requires giving up a slogan on each side.

The two tests were testing different claims. The war test asked: is Bitcoin still a panic asset, sold reflexively on any shock? The answer is no, and that answer is genuinely new, structurally grounded in the changed holder base, and worth something. The tech test asked: is Bitcoin an uncorrelated hedge against the financial system? The answer is also no, and the honest advocates conceded that one quarters ago. What remains, once both slogans are surrendered, is a precise and actually useful identity: Bitcoin is a liquidity asset. It prices the supply of money and the appetite for risk, with almost nothing else admitted. Missiles do not move it, because missiles do not move M2. CPI moves it. The Fed moves it. The AI trade moves it, because the AI trade is currently the main pipe through which risk appetite expresses itself.

This is narrower than digital gold and more dignified than Nasdaq beta, and it maps cleanly onto the original thesis if you read the original thesis carefully. Bitcoin was designed as a hedge against monetary debasement, not against geopolitics. Gold hedges both, which is why gold rose on the missiles and on the money. Bitcoin hedges one, with leverage and volatility attached, and it spent this week showing precisely that split: flat on the geopolitics, violently responsive to anything touching rates and liquidity. Holders who wanted a war hedge bought the wrong asset, and this week told them so gently, without even charging them for the lesson. Holders who want a monetary hedge own an instrument that is currently marked 50% below peak because the monetary environment, restrictive rates, a hawkish chair saying the inflation fight is not over, oil threatening the rate-cut path, is exactly what it is priced to hate.

The short-term picture follows from the identity. Polymarket puts the odds of the Fed holding rates at the July meeting at 94%, allocators warn the restrictive regime could stretch into late 2026, and every barrel Brent adds on Hormuz risk tightens the constraint further by feeding the inflation the Fed is fighting. The path for a liquidity asset in that world runs through the liquidity, not the headlines: Bitcoin’s war, the only one it has ever traded, is with the FOMC.

The test the week did not run

Intellectual honesty requires naming the scenario this week’s experiment never reached, because both readings survive it only by assuming it away.

The war leg tested limited escalation: strikes, shipping attacks, a contained supply scare that added a risk premium to oil without breaking the market’s basic assumption that the conflict stays regional. Bitcoin’s indifference to that is now on the record. What remains untested is the discontinuity, the event large enough to jump categories: a sustained closure of the Strait of Hormuz, through which roughly a fifth of global oil transits, a direct exchange that pulls in Gulf producers, anything that converts a risk premium into a supply crisis. In that world the transmission channels stop being separable. Oil gaps rather than climbs, imported inflation stops being a forecast and becomes a print, the rate-cut path does not narrow but closes, and the same liquidity channel that Bitcoin trades every day delivers the geopolitical shock it has been ignoring, at full force, all at once.

How Bitcoin behaves in that scenario is simply unknown, and the week’s evidence supports two incompatible guesses. The maturation evidence, unlevered holders, flat funding, treasuries that do not move, suggests the asset rides through even that, repriced lower with everything else but without the panic mechanics of old. The liquidity-asset evidence suggests something harsher: if Bitcoin is the highest-beta expression of dollar liquidity, then the moment a geopolitical event tightens liquidity violently is the moment Bitcoin underperforms everything, including the chip stocks, because beta is symmetric and the direction is down. Gold, meanwhile, would be doing what it did this week at ten times the scale. The divergence that measured 60 basis points on a Thursday could measure twenty points in a crisis, and every allocator holding both assets as interchangeable hedges would discover the difference in a single session.

There is one more asymmetry worth logging before the test arrives. Bitcoin’s calm this month was partly a positioning artifact, the absence of a crowded leveraged side to liquidate, and positioning is the least stable fact in markets. The structure that produced the indifference, ETF-heavy ownership, flat funding, modest open interest, is a snapshot, not a property of the asset. A two-month rally that rebuilds leverage restores the old transmission mechanism intact, and the next Hormuz headline would find the flush the last one could not. The market has not learned to ignore war. It has, for the moment, arranged itself so that war has nothing to grab. Those are different achievements, and only one of them survives a change in the funding rate.

Which is the honest caveat to the week’s clean result: the experiment ran under laboratory conditions, limited war, clean positioning, a soft CPI at its back. The finding, that Bitcoin trades money and not missiles, is real and holders should build on it. The confidence interval around it should stay wide enough to admit the one scenario where money and missiles become the same variable, because that is the scenario in which the distinction this article has carefully drawn stops mattering, and the only hedge that works is the one that was never correlated to begin with.

Institutional investors are looking beyond smart contract audits after traditional trust signals such as prior audits and operating history failed to predict which crypto projects would be exploited, according to Hacken.

In its Q2 2026 Security & Compliance Report, Hacken said that only 9% of 1,427 tracked projects had third-party monitoring, while 4% combined monitoring with an active bug bounty and a security audit. The report highlighted that compromised keys, signers and infrastructure accounted for 88.3% of the roughly $764 million stolen during the quarter. 

Hacken said projects unable to provide ongoing evidence of operational security may face higher perceived risk, reduced investment and more difficult access to insurance or counterparties. 

Contributors to the report included Federico Bagiotti, group head of risk management at Abraxas Capital, who said “inadequate security relative to the capital at risk” was the signal that most often led the firm to reject an otherwise attractive position. Rajeev Bamra, Moody’s Ratings’ head of digital economy strategy, said that operational resilience had become “the practical lens” through which institutions evaluated security, compliance and governance.

Security controls among those reviewed. Source: Hacken

Operational security becomes an allocation test

The report said institutional due diligence is beginning to include signer-set changes, collateral backing, third-party dependencies, incident-response readiness and the scope and recency of audits. Abraxas said it now explicitly screens for timelocks, withdrawal-address whitelisting, multiparty controls and single-key or single-verifier dependencies.

The shift has also appeared in regulatory and industry scrutiny. In a July 10 Cointelegraph report, BitGo Chief Operating Officer Jody Mettler said institutional clients had begun asking more detailed questions about custody providers’ access controls, incident response and business continuity as European regulators examined operational resilience under the Digital Operational Resilience Act (DORA).

Related: Crypto hacks fell 47% in H1 but ecosystem is no safer: CertiK

Hacken said 14 projects exploited in the second quarter had previously been audited. However, most losses stemmed from areas outside the scope of conventional smart contract reviews. The affected surfaces included signer devices, bridge validators, backend infrastructure, admin keys and older contracts that remained live despite being deprecated. 

The dataset covered 1,427 projects with market caps above $1 million, drawn from assets listed across the top 50 centralized exchanges by CoinGecko Trust Score. Hacken excluded wrapped assets, stablecoins and tokenized real-world assets. Its data relied on publicly observable and disclosed controls, which means that private arrangements may not be captured. 

Magazine: Ethereum’s EEZ could pull other blockchains into its orbit