There are lots of crypto projects who have never been hacked - Compound, Balancer, AAVE - etc.
Banks need top grade security, and making a bank in crypto is hard. Because of the absence of regulation, what you’re getting right now is a lot of DeFi projects that are poorly secured. You take the risk you’re willing to take really.
More like 'barely meets the threshold for compliance with regulations and laws if you glance sideways at it through a foggy pane of glass' security.
While most do have adequate security, many banks are self-insuring for several classes of risk, including several that self-insure for cybersecurity issues. They depend heavily on support from LEOs, centralization of clearing operations, and established norms on how to interact with each other through ISACs and other industry associations - something that cryptocurrency and decentralized finance currently lack.
Every project will say that they have great security, but without external validation or regulation, how do you know which of them are mistaken or outright lying.
If you're interested, here's an overview of the honeypot scam (common with DeFi tokens) and how we're helping alert users to it: https://agentsofinu.medium.com/the-honeypot-scam-what-is-it-...
IMO security just comes from time spent operating vs amount of hacks. If you've been operating for a couple of years with no known hacks then I trust the team behind the project.
Also as monox (who got hacked this week) shows 3 audits this year are no guarantee https://docs.monox.finance/library/audits
The entry to creating your own token is so low that people with little to no coding experience are attempting to add/modify functionality. Community insistence to get audited is useful to pick up on these.
Cyclists have a saying: there are two kinds of cyclists, ones that have crashed, and ones that are going to crash.
I think crypto exchanges can be similarly partitioned: there are two kinds of crypto exchanges, ones that have been hacked, and ones that are going to be hacked.
It's just ideal conditions: lots of money, software, no regulation/oversight, anonymous criminals.
Your overall point is valid though, and it's not like it happens just in crypto - e.g. this paypal auth hack is not too disimilar and that's a much bigger company[1].
0. https://decrypt.co/82387/defi-community-blasts-compound-ceo-...
1. https://www.consumeraffairs.com/news/paypal-hackers-are-targ...
This sounds like a bug, not an exploit.