Grayscale's 'Nine-Year Low' Is a Statistic Without a Chain of Custody
Grayscale has declared victory over crypto crime. The asset manager's latest research note claims Bitcoin and cryptocurrency hack incidents have fallen to a nine-year low, and that this decline is proof that security measures are working. The conclusion is comfortable. The data underneath is not. Every timestamp is a potential crime scene, and this report does not even provide a timestamp. No methodology. No data source. No definition of what 'low' means. Silence in the logs screams louder than alerts, and this particular silence contains all the information that matters.
Grayscale is not a neutral observer. It is the issuer of GBTC, the largest Bitcoin trust that converted into a spot ETF, and it manages billions of dollars in digital assets. Its research arm produces content calibrated to support institutional adoption. That is the context for a report telling institutional investors the security fears accumulated during FTX, Terra, and a parade of cross-chain bridge exploits were overblown. The report lands at a moment when SEC-registered crypto products need inflows and when traditional allocators are under pressure to explain why they have not yet participated. The report's timing and its ownership structure do not invalidate its claim. They do make it a commercial artifact rather than a purely academic finding.
Take the underlying claim at face value: hack incidents are at a nine-year low. What does that mean? In 2023, industry trackers recorded roughly $1.7 billion in hacks and exploits. If 'low' refers to total dollar losses, 2023 does not look like a nine-year low. If it refers to the number of incidents, a year can contain many small attacks and one massive one; the aggregate number can fall while tail risk rises. If it refers to losses denominated in Bitcoin, the metric is distorted by Bitcoin's price appreciation. Nine years ago, Bitcoin was worth a few hundred dollars. A lost Bitcoin in 2015 is not the same dollar event as a lost Bitcoin in 2024. The report does not say which of these it used. That is not a footnote. It is the entire story.
The metric problem is unresolved. A nine-year low in attack frequency is not the same as a nine-year low in risk. Frequency is a count of events. Risk is probability multiplied by impact. A $625 million Ronin Bridge exploit creates a year with one incident but enormous severity. Conversely, a spike in small phishing attacks can make frequency look dangerous while total losses remain modest. Without knowing whether Grayscale measured incidents, dollars lost, or BTC lost, the reader cannot decide if the industry is actually safer or just quieter. The bug hides in the whitespace you skipped, and here the skipped whitespace is the methodology section that does not exist.
Causality is more fragile. The report attributes the decline to improved security measures. That is partially true. Cold storage has become the institutional default. Multisignature wallets and timelocks are no longer optional. On-chain monitoring firms such as Chainalysis and TRM Labs have turned incident tracking into a professional service. Bug bounty programs are common enough that a project without one is an anomaly. I spent ninety days manually auditing the 0x Protocol v2 smart contracts back in 2018, and the gap between the security culture I saw then and the security culture in modern institutional custody is enormous. The progress is real. During the MakerDAO oracle crisis in 2020, I traced failed liquidations block by block for three days; what mattered was not the aggregate number of attacks, but the exact block where the price feed stalled. It was never enough to know that hacks had fallen. You needed to know where the mechanism broke.
But the decline has other explanations. A bear market is the most obvious one. When total value locked shrinks and new token launches slow down, attackers have fewer high-reward targets. The decline in hacks is not only a result of better defenses; it is also a result of a smaller attackable surface. Additionally, some attackers have simply migrated to off-chain fraud: fake investment apps, phishing portals, and celebrity impersonations. Those are less likely to appear in a blockchain-specific hack ledger. The ledger bleeds where logic fails to bind, but sometimes the bleeding stops because there is less blood left in the arena.
Scope creates the sharpest distortion. Bitcoin's base layer has not changed fundamentally. Consensus is still proof-of-work. The UTXO model is still the UTXO model. The security improvement is not an upgrade to Bitcoin consensus. It is an upgrade to the perimeter: custody, insurance, monitoring, and audit. That distinction is critical. If Grayscale's report covers all of crypto, it cannot ignore the 2021-2023 bridge attacks that drained hundreds of millions from Wormhole, Nomad, and others. If it covers only Bitcoin, then the nine-year low is almost tautological, because Bitcoin's application layer is tiny compared to DeFi. A smaller attack surface produces fewer incidents. That is not a triumph; it is arithmetic.
There is also the question of provenance. Grayscale is an SEC-regulated entity, but its research department is not a peer-reviewed academic institution. The report should have disclosed whether the underlying data came from Chainalysis, TRM Labs, an internal aggregator, or a marketing estimate. It should have disclosed the cutoff date, the definition of a hack, whether returned funds are subtracted from losses, and how severity is categorized. Without that, the statistic cannot be reproduced. In security, an unverifiable claim is equivalent to an unpatched vulnerability. A finding without a proof of concept is just a rumor. A trend without a methodology is just a pitch.
Now the contrarian point. The bulls are not wrong that security infrastructure has matured. I have reviewed contracts in 2021 where a single admin key controlled everything, and I have reviewed contracts in 2025 where access control is split across multisig, timelocks, and emergency pause mechanisms. Institutional custody is a different beast from the early exchange wallets. Insurance markets exist for cold storage losses. Formal verification is no longer an academic pipe dream; it is a line item in serious security budgets. These are genuine improvements. Anyone who says the industry has not become safer since 2018 is not paying attention.
The problem is the packaging. Calling a fragile trend a nine-year low converts a work-in-progress into a completed victory. That is how security narratives die. They do not die because the first exploit happens. They die because the market is convinced that the next exploit cannot happen. Reputation is liquid; solvency is binary. The industry can survive a single exploit if it responds correctly. It cannot survive a false confidence that leads to complacency. Grayscale's report is not a security insurance policy; it is a marketing message with a statistical veneer.
If Grayscale wants to build a credible security metric, it should publish incident counts by attack vector, dollar losses by category, recovery rates, time-to-detection, and loss per unit of total value locked. It should include a counterfactual: what would the loss rate have been if the old custody practices were still in place? It should identify the source of every data point and the assumptions used to classify events. None of that is impossible. It is simply expensive and inconvenient. The fact that the report did not include any of it tells you what the report is for.
The takeaway is not that hacks are actually rising. The takeaway is that the industry has not built the statistical infrastructure to support the claims it wants to make. Grayscale's report will be quoted in boardroom decks and ETF marketing materials. It may even move marginal capital into crypto products. But the statistic is not a shield. The next major exploit will not ask for Grayscale's definition of a 'hack incident.' It will simply execute. Trust is a variable, never a constant. The question worth asking today is not whether we are at a nine-year low. It is whether the industry's response mechanisms are ready for the next high-severity event, because that event will come. Code does not lie; it merely waits.