The crypto space is rife with inside jobs, but I think most of the ICO hacks are real. There's not a strong incentive to run an ICO hack when you'd otherwise just get the money without much accountability.