83 projects got exploited in Q2 2026. $755M gone because nobody could see risk in advance. Every one of those exploits was foreseeable: a missing control (key management, least-privilege, incident prevention) plus a market trusting the wrong evidence. Like a high-tier partner; a healthy TVL; an active timeline. People bought, deposited, allocated, and then got rekt. Not blaming them. All those signals describe a project's health. They tell you nothing about the risks that enable the exploit. And here's what changed: capital is no longer run by people; now, agents can route it too. Neither you nor a model can read every postmortem before allocating. So the market needs one number instead. That's the Probability of Loss: a 0-100 score computed from public data alone, built by reading historical failure patterns, a project's live parameters, and its likely attack paths. It just makes risk readable before you face the loss, not after. We released the CORE3 litepaper today: the what, the why, the how. Read it: core3.io/Litepaper_CORE3_Pro…

The cybersecurity component of @coingecko's Trust Score now uses CORE3 data for 166 centralized exchanges. The migration from CER.live to CORE3, @hackenclub's risk infrastructure layer, preserves continuity in a signal CoinGecko users already rely on. The exchanges' security scores are expected to move no more than 2%. CoinGecko continues to display penetration testing, bug bounty, and Proof of Reserves indicators. CORE3 has evolved internally from a standalone security evaluation into a broader risk intelligence framework covering Security, Solvency, and Transparency dimensions. Together, these indicators contribute to the Probability of Loss, which estimates the likelihood of an adverse event arising from a security breach, insolvency, or operational failure. This places cybersecurity evidence alongside solvency and disclosure data, supporting more consistent exchange due diligence and counterparty exposure decisions. See what changed: core3.io/blog/core-3-news/co…

Did 0% audit coverage contribute to the exploit of @harmonyprotocol? Harmony just had ~4B $ONE created from a consensus-layer exploit, ~26% of the circulating supply CORE3 Probability of Loss for Harmony is at 52/99 with low Security and Operational subscores What happened⬇️ This is Harmony’s third protocol-level security failure in four years and its second unauthorized-issuance event. Different exploit path, same risk domain: supply integrity. Current analysis points to two verification failures: cross-shard receipts could be replayed to credit a destination without debiting the source, while a pre-staking quorum check could be satisfied without a valid signer set. The result was phantom supply created at the protocol layer. Around 2.8B $ONE was routed toward centralized exchanges before containment. There was no automated minting circuit breaker, so stopping the exploit required validators to manually upgrade. For institutional review, the key diligence shift is straightforward: audit coverage must extend beyond smart contracts into consensus and client-level logic, because that is where this exploit occurred. Supply integrity also cannot rely solely on native chain reporting; it requires independent verification of issuance and state transitions. Finally, there must be enforceable, automated controls that can halt abnormal minting or issuance in real time, not just post-incident response. Probability of Loss (PoL) is the current risk read. Incidents like this are why that read has to move with the project, its controls, and the evidence behind them. Review Harmony’s risk profile on CORE3⬇️ bit.ly/pol_harmony

CORE3 supplied the security posture data on 1,427 Web3 digital asset issuers for Hacken's Q2 2026 report. And that’s the start of the bigger story for CORE3, for you, and for Web3. Starting this quarter, risk infrastructure becomes backed by the weight of @hackenclub's ecosystem with its 9-year track record of blockchain security & compliance. What doesn't change is Probability of Loss. Methodology remains publicly unchanged, independent, and replicable. The team behind previously CORE3 built CER.live, the cybersecurity score provider for @coingecko's CEX Trust Score, so we know what it takes to change the digital asset industry once more with actionable risk data. Measure risk, for the public good.

Recently, @kucoincom turned 9, and the CORE3 team attended the celebration at @tomorrowland. During the event, we heard and started countless conversations, including with the KuCoin team, on what today matters in the digital assets market: risk management, openness, self-assessment, and accountability. Symbolically, KuCoin’s Probability of Loss on CORE3 shows “99” for security, contributing to an overall PoL of 5.42. This places the exchange #1 ranked by the lowest risk exposure on our platform. A few moments from the celebration below. CORE3. Risk, measured in public.

An agent can be fully audited yet still allocate capital recklessly or manage risk effectively while remaining dependent on a single, fragile oracle. CORE3 contributed its evidence-based risk methodology and independently assessed agents to @owneydotapp alongside @CODESPECT, and @hackenclub to build the first Trust and Security framework for Agentic DeFi Yield across Security, Risk, and Robustness to make failure paths measurable 🔽

44 out of 67 incidents in Q2 were smart contract exploits. So how do you know you won’t get hit next? CORE3’s security domain is built heavily around onchain security. Even a simple thing like smart contract audit is reviewed rigorously, giving you more information about it: scope, deployed versus audited code, unresolved findings, remediation, severity, and auditor tier. This separates a narrow contract review from coverage of the infrastructure that actually moves funds. Audit covers only one part of the whole security checklist, the remaining test the post-deployment controls: Bug bounty - a funded vulnerability disclosure path. Third-party monitoring - detection of abnormal calls, upgrades, or outflows. Prevention - timelocks, pauses, and circuit breakers that can contain loss. For institutions, the result is not an audit badge. It is a control map for pre-allocation screening, counterparty limits, and ongoing review. When evidence or controls change, the security read changes accordingly. Review the methodology on CORE3.io

The PoL score stayed; the data behind it got stronger. Funding through @Giveth helped us improve how risk is collected, reviewed, calculated, and delivered across CORE3. More human context Over 1,500 @Proof_Of_Voice reports now appear beneath project scores, providing readers with expert context alongside the underlying risk data. The reports can now be submitted through the website or Telegram Mini-App, making contributions easier and expanding project coverage every day. Cleaner project data Duplicate and empty bug bounty entries were removed. Audit records were standardized. Detector-collected evidence now fills key fields across token supply, contract verification, team transparency, KYC, regulation, insurance, and security certifications. Better comparisons Projects are now ranked both across CORE3 and within their own category, so protocols are compared against relevant peers. Exchange data covering penetration tests, bug bounties, and proof of reserves was also corrected and expanded. Stronger scoring infrastructure We improved the Probability of Loss engine, scoring logic, detector persistence, and data pipelines to ensure risk profiles are consistent and up to date. CORE3 for the agents Our public MCP server is already in production, allowing AI assistants to query CORE3 risk data directly. Thanks to @Giveth, @TheDAOfund, @wintermute_t, @Quantstamp, @CredShields, and the community donors who helped fund the work.

CORE3 data supports the Q2 report’s protocol-risk section While Public markets expect compliance-grade controls, Web3 industry answers with: • 55% - an active bug bounty • 26% - security audit on record • 9% - third party monitoring • 4% - all 3 at once Full report⬇️

A project that looked acceptable last quarter can become a material counterparty risk today. For institutions, the relevant signal is how the score changes after capital is deployed. Risk rarely stays static. New dependencies appear, audits become outdated, admin controls change, incidents expose weak controls, and unresolved findings accumulate. That's why Probability of Loss dynamics matter. A rising risk score should trigger a review: what changed, which control weakened, and whether the amount of capital you have allocated to that project remains appropriate given the higher risk. PoL score that continuously lowers means that risks have been addressed and mitigated. This also highlights that the project is focused on improving security and building trust. The current Probability of Loss reflects the current risk level. Its trajectory shows how that risk is changing over time, after launch, after the growth phase, and through periods of stress. Track counterparty risk dynamics on CORE3.io

Crypto wants your money but refuses to make risk easy to understand This will not work in the next adoption cycle, where users, funds, and partners expect clear, comparable risk before committing capital. A new approach is needed, one that makes loss exposure visible before any capital commitment. Probability of Loss (PoL) turns security, operations, finances, reputation, regulation, and dependencies into one readable risk score, with @Proof_Of_Voice as the human expert layer adding context behind the scores. Stop guessing and start measuring risk before you commit capital. Explore Probability of Loss on CORE3.io