Beneath the latest Grayscale research note, a number has already begun to move allocation decisions: crypto hacking events are at a nine-year low. The market reads that as maturity. I read it as a metric waiting for a qualification.
I have spent my career treating security reports as forensic documents, not press releases. In 2017, I audited over 40,000 lines of Solidity for three early-stage ICO teams in Berlin. The experience gave me a permanent allergy to headline statistics. The contracts looked fine until you checked for reentrancy. The project looked funded until you checked the multisig. The market looked safe until you checked who compiled the data. So when an asset manager with billions of dollars in crypto trust products publishes a report that says “nine-year low,” my first question is not whether hackers became less effective. It is who counted the events, who categorized them, and who benefits from the count.
The Seller of Safety
Grayscale is not a security research firm. It is an asset manager that built its business on converting Bitcoin exposure into a regulated product. The report that generated the “nine-year low” headline is not a technical paper or a vulnerability disclosure. It is a narrative instrument dropped at a delicate moment: spot Bitcoin ETFs have been trading for months, custody rules are under review, and institutional capital is looking for an excuse to move. This report is one of those excuses.
Let me place the claim in its structural context. Grayscale converted its flagship Bitcoin Trust into a spot Bitcoin ETF and now competes with BlackRock, Fidelity, and Bitwise for the same fee-sensitive institutional wallet. It also won a landmark legal case against the SEC in 2023, and that victory helped unlock the very ETF products now competing against it. Every research note Grayscale publishes is therefore a marketing asset as much as an analytical document. The “nine-year low” claim is no exception. It reassures allocators that the asset class is maturing exactly when those allocators are preparing to justify a first crypto purchase to an investment committee. In that context, the report is doing more than reporting. It is constructing the institutional permission structure for buying Bitcoin.
The Denominator Problem
The first thing any security engineer should do with a statistic is ask what is in the denominator. “Nine-year low” only has meaning when you specify what is being measured. Is it the number of hacking events? Is it the total dollar amount lost? Is it the amount lost denominated in Bitcoin? These three metrics tell very different stories.
The crypto industry has produced enough large single attacks to make a count-based statistic almost meaningless. Consider 2022: Ronin Bridge lost roughly $625 million in one event. Wormhole lost $326 million the year before. Nomad Bridge lost around $190 million. In 2023, total losses across DeFi and centralized services still exceeded $1.7 billion, according to multiple on-chain analytics firms. A “nine-year low” in event count can exist alongside a fat right tail. A $600 million loss is one event. A hundred phishing attacks are a hundred events. Which number should a risk committee fear? The answer is the dollar-weighted tail, not the event frequency.
If the report uses a rolling 12-month window, the number becomes even more fragile. Security statistics in crypto are not produced by an independent standards body. They are scraped from Telegram channels, bug bounty programs, audit reports, and post-mortems. Definitions vary across data providers. Some trackers count private-key compromises as hacks. Others exclude them. Some include social engineering. Others do not. The summarized version of the Grayscale report does not disclose its definition. Without that disclosure, the “nine-year low” is a floating object that can be moved by changing a single line of classification code.
What Actually Improved
That does not mean the security environment did not improve. It did. But the improvement happened in the right places and for the right reasons, and it is worth separating those from the parts of the narrative that do not hold.
In 2017, I found ICO teams storing private keys in plaintext emails. Today, leading custodians use multiparty computation, hardware security modules, insurance wrappers, and real-time monitoring. Multisignature is not a niche practice; it is the default. Bug bounty programs are a standard budget line. Formal verification tools have migrated from academic papers into production workflows. The gap between the security infrastructure of 2017 and today is enormous, and I do not dismiss it.
But the progress is on the perimeter, not on the core. Bitcoin's Proof-of-Work consensus and UTXO model have not changed materially in nine years. The documented reduction in hacking events is a story about custody, audits, monitoring, and insurance. It is not a story about a fundamentally safer protocol. That distinction is not semantic. When an asset manager says “crypto hacks fall to a nine-year low,” the implication is that the asset itself is safer. The asset is exactly the same. The surrounding infrastructure is marginally less fragile.
The Bear Market as Security Officer
The least discussed explanation is the bear market itself. Attackers are not anonymous thrill-seekers; they are economic operators. Stolen assets need to be laundered, and that requires liquidity. In 2021, an attacker could move funds through decentralized exchanges, bridges, and mixers within minutes. By 2022 and 2023, exchange KYC rules tightened, mixer services either collapsed or were labeled toxic, and law enforcement agencies built dedicated on-chain tracking units. The cost of monetizing stolen assets rose. When the expected value of an attack falls, the volume of attacks falls, even if the underlying code is equally fragile.
I saw exactly this dynamic when I built a Python model during DeFi Summer. I simulated 10,000 yield farming iterations to study impermanent loss in Curve's stablecoin pools. The average return looked healthy. The left tail was catastrophic. The same structure applies to security statistics. A decline in event count describes the middle of the distribution, not the tail. The tail is too rare to show up in a quarterly chart, but it is exactly where the biggest losses live. One large bridge hack can erase a year of progress in a single atomic swap.
The same reasoning applies to the Terra collapse, which I spent three months reverse-engineering after the crash. The community focused on the optimistic narrative of “safe yield” while ignoring the relationship between reserve depth and withdrawal velocity. The death spiral was not an infrastructure failure; it was a narrative failure with an infrastructure tail. The current “nine-year low” narrative carries the same shape. It is a broadcast, not a measurement. It feels reassuring until the next event exposes the assumptions.
The Provenance Problem
This is where I return to my own forensic habits. In 2021, when the NFT market was pricing Bored Apes as blue-chip assets, my forensic lens on the blue-chip provenance trail revealed a fragmented claim: a meaningful share of metadata still resided on centralized IPFS gateways. The market was paying a blue-chip premium for infrastructure that was not blue-chip. The lesson was not that the collection was a fraud. The lesson was that provenance determines the risk-adjusted price of a narrative.
The Grayscale report has the same problem. If its data comes from Chainalysis or TRM Labs, a reader at least has a chance to evaluate the methodology. If the data comes from an internal compilation, the “nine-year low” has no verifiable provenance. The summarized report does not disclose its source. For an asset manager that positions itself as the bridge between crypto and institutional capital, that omission is a red flag.
The absence of a public methodology matters more than the direction of the number. A nine-year low could be true under one definition and false under another. Without the underlying data, the market cannot reproduce the result. In any other branch of finance, a research report with this degree of policy influence but this little data transparency would not survive a first round of peer review. Grayscale is not obligated to publish its full dataset. But the reader should understand that the number is a claim, not a fact.
The Narrative Construction Cycle
The timing of the report is also a message. Security narratives in crypto run on cycles. After FTX, the market learned that counterparty risk is itself a security issue. After Ronin, the market learned that cross-chain bridges are a security issue. After SAB 121, the market learned that custody accounting is a regulatory issue. Grayscale now operates an SEC-approved ETF product and wants to separate Bitcoin from the tail risks of its own industry. The “nine-year low” is exactly the kind of narrative tool that accomplishes that.
It gives institutions the language they need: the infrastructure has matured, the risks are lower, and the rejection reasons are obsolete. That is not an accident. It is the function of a research arm inside an asset manager. The question is not whether Grayscale is trying to send a positive signal. Every asset manager does. The question is whether the signal is transparent enough to be stress-tested.
The Market's Misread
The market will likely treat this report as a bullish signal. It should not. There is no direct price catalyst in a security statistic. The number can support a broader thesis about institutional adoption, but it cannot justify a change in Bitcoin's valuation model. The report's real impact is psychological. It gives portfolio managers permission to say that the asset class is no longer as dangerous as it was in 2021. That is a shift in narrative, not fundamentals.
But the report also creates a second-order risk: overconfidence. If a single major hack occurs after the “nine-year low” has been widely cited, the dislocation could be worse than if the statistic had never been published. The market will remember the report not as a snapshot but as a promise. When a narrative overshoots, the correction does not always return to the prior baseline. It often goes lower.
This is why I keep returning to structural resilience. A security claim is only as strong as its weakest data source. Grayscale's report, as published, has a strong editorial message and a weak methodological footprint. That imbalance is precisely the kind of thing an allocator should flag in a portfolio review. The number is not wrong. It is unproven. In a market that has been burned by unproven narratives, that distinction is not a footnote. It is the entire story.
The Contrarian Read
Now for the contrarian reading. The report is not false; it is dangerous because it is directionally true. Security has improved in some corners. But the improvement is not evenly distributed across the sector. Bitcoin custody is safer. DeFi code is still a minefield. Cross-chain bridges remain high-risk. The gap between the safest infrastructure and the average protocol is widening, not narrowing. A report that aggregates all crypto hacks into a single number hides that divergence.
It also hides the fact that the industry's most expensive failures were not hacks in the traditional sense. FTX, Celsius, and Voyager were governance, accounting, and liquidity collapses. If the Grayscale metric excludes those events, the “nine-year low” says nothing about the dominant institutional risk of the last cycle. A risk committee that relies on the report to conclude that crypto is safe is missing the most important part of the threat model.
The more uncomfortable possibility is that the decline in hack losses is tied to centralization. Regulated custodians, centralized exchange compliance, and aggressive law enforcement have made the intermediated path safer. That does not mean self-custody is safer. It means the safest place for an institution to hold crypto is a regulated intermediary. The resulting narrative is not “crypto is secure by design”; it is “crypto is secure when it is controlled by institutions.” That is a better story for Grayscale than it is for the decentralization thesis. The nine-year low may be less a sign of maturity and more a sign of consolidation.
This is also why the report's regulatory effect matters. Custody security has become a policy battlefield. The SEC's SAB 121 created accounting burdens for institutions that hold digital assets. The industry responded by arguing that custody practices have matured. A report claiming a nine-year low in hacks is the perfect supporting exhibit for that argument. It may also be a much quieter way of asking regulators to relax their assumptions. That is not necessarily invalid. But it means the report is advocacy as much as analysis, and its data should be held to the same standard as a legal brief.
A Call for Data Independence
What Grayscale should have done, but did not, is publish the raw data alongside its report. Security statistics in crypto are too supply-chain dependent to be left inside an asset manager's research engine. The data providers are also part of the ecosystem. Chainalysis, TRM Labs, and Elliptic sell intelligence to exchanges, regulators, and institutions. Their definitions of an “event” are not neutral. A phantom attack on a test network might count in one ledger and not in another. A reorg, a gas grief, an oracle manipulation, a governance exploit—all can be classified differently depending on who is paying for the report.
The industry needs an independent coalition that audits security statistics the way financial auditors audit balance sheets. Until that coalition exists, every “nine-year low” should be read with a label: unaudited, source not disclosed, methodology not available. That label is not a condemnation. It is the minimum warning standard for a claim that will be used to justify real money.
This is not an argument for paralysis. It is an argument for asymmetry. The institutional investor who reads the report and asks for the dataset will be ahead of the institution that reads the report and moves capital. The analysis phase is where risk gets priced. The narrative phase is where risk gets sold. Grayscale has written a narrative; the allocator's job is to demand the analysis.
What Should Replace the Metric
What would replace the nine-year low? Start with a loss-severity distribution rather than a single average. The market needs to know the median loss and the 99th percentile loss, not just the number of events. A decline in median incident size is meaningful; a decline in tail frequency is not statistically robust.
Next, an attacker-migration map. Security analysts should track where attacks are moving. If the dominant attacks shift from bridge exploits to social engineering and private key compromises, the required defense changes. The report's current framing treats all hacks as one security phenomenon, which is analytically wrong.
The third metric is a custody-specific incident rate. Institutional allocators do not need to know whether all of crypto is safer. They need to know whether the specific custody structure they are considering—regulated ETF, qualified custodian, self-custody—has a measured failure rate. Aggregating Bitcoin network hacks with DeFi protocol hacks and exchange hacks produces a number that is too abstract to inform a capital allocation.
Those three metrics are harder to headline. They also reflect the reality that security risk is not one number. It is a set of distributions across different attack surfaces. The sooner the industry stops compressing those distributions into a single narrative, the sooner institutional investors will get the signal quality they actually need.
The Takeaway
Tracing the genesis block of market sentiment, the report tells us less about Bitcoin's security and more about the security-selling industry. The nine-year low is a compiled statistic, assembled from undisclosed definitions and released by a stakeholder with a direct commercial interest in institutional adoption. That does not make it useless. It makes it a number to be stress-tested, not cited.
Truth is not found; it is compiled. The next bull market will not be built on a lower hack count. It will be built on the conviction that the infrastructure can survive a large failure without triggering a systemic crisis. That conviction cannot be compiled from one statistic. It can only be earned through transparent disclosures, reproducible data, and custody models that can be audited by the people allocating the capital.
The real question for allocators is not whether hacks are at a nine-year low. The question is who counted the hacks, and what did they leave out. Until that question is answered, the nine-year low is a marketing artifact, not a risk metric.