Crypto platforms lost $3.63 billion across 245 documented security incidents between January 2025 and July 2026, according to CoinGecko’s State of Crypto Security Report published on Aug. 27.
Summary
- Crypto platforms lost $3.63 billion across 245 documented incidents between January 2025 and July 2026.
- Ten largest attacks accounted for more than 72.5% of all recorded stolen funds combined worldwide.
- Audited platforms represented 147 incidents and 88.44% of reported losses during the study period overall.
- Only 11% of incidents involved vulnerabilities covered by routine smart-contract audit scopes, CoinGecko reported publicly.
- Active onchain insurance coverage fell 20.2% to $130.2 million while five protocols exited or pivoted.
Losses were heavily concentrated. The ten largest attacks accounted for more than 72.5% of the total stolen value, while infrastructure and supply-chain compromises caused more than $1.8 billion in losses.
CoinGecko identified private-key compromise as the leading risk for centralized exchanges. Decentralized applications lost approximately $546 million through smart-contract exploits, while both platform categories also faced oracle manipulation and internal-mechanism failures.
The figures represent CoinGecko’s incident dataset. The published summary does not clearly state whether every recovered or frozen asset was deducted, so the $3.63 billion should be treated as its reported loss estimate rather than a final net-loss total.
Crypto security losses were concentrated in major attacks
The February 2025 Bybit breach was the largest incident included, accounting for approximately $1.44 billion. The attack involved compromised transaction-signing infrastructure rather than a defect in an exchange smart contract.
Other major incidents included the $292 million KelpDAO breach, the $285 million Drift Protocol attack and the $223 million Cetus exploit. Their different methods show why one security control cannot cover the industry’s complete attack surface.
Infrastructure attacks can target private keys, employee devices, front-end interfaces, software dependencies and bridge operators. These components often sit outside the smart contracts reviewed during conventional audits.
State-backed groups have also adopted longer and more complex operations. As previously reported, two North Korea-linked attacks drained approximately $577 million through social engineering and bridge infrastructure compromises rather than ordinary contract flaws.
Audits covered only a minority of exploited weaknesses
CoinGecko found that 147 of the 245 affected platforms, or about 60%, had completed an independent security audit before they were attacked. Those platforms accounted for 88.44% of recorded losses.
That finding does not establish that auditors approved the vulnerable component. CoinGecko said only approximately 11% of incidents involved flaws that fell within the scope of routine smart-contract audits.
Those in-scope failures still caused about $396 million in losses. Most other incidents involved external infrastructure, unaudited software updates, compromised credentials or governance mechanisms that the audit did not assess.
An audit is also a snapshot of a particular code version. Changes made after the review may introduce new vulnerabilities. Its effectiveness depends on the scope, methodology, auditor experience and whether developers resolved the findings.
In related coverage, Ripple’s security review identified 96 issues before affected code reached users, showing that audits can prevent losses when findings arrive before activation. They cannot replace continuous monitoring and operational security.
Onchain insurance capacity fell as attacks increased
Active coverage across leading onchain insurance protocols declined 20.2%, from $163.2 million to $130.2 million. Cumulative payouts remained near $33 million, according to CoinGecko.
Five of the nine protocols tracked had become inactive or moved into other business areas by August 2026. CoinGecko attributed the retreat partly to elevated risk, expensive premiums and difficulty attracting capital providers.
The $130.2 million coverage figure should not be compared directly with $3.63 billion as a formal coverage ratio. The first is a point-in-time measure, while the second covers cumulative incidents across 19 months.
Policies also contain narrow definitions. Some cover verified smart-contract failures but exclude phishing, private-key theft, employee mistakes, market volatility and losses involving unsupported chains.
Exchanges increasingly rely on self-funded reserves
Centralized exchanges have increasingly established investor-protection funds instead of purchasing full external insurance. These reserves can provide faster reimbursement after a breach.
However, a protection fund is not automatically equivalent to regulated insurance. Coverage depends on the exchange’s terms, reserve custody, asset composition and discretion over qualifying events.
Proof-of-reserves attestations address another issue by showing that an exchange controls assets corresponding to customer balances. They do not establish secure key management or prove that all liabilities have been disclosed.
The report’s next test will be whether platforms expand audits beyond smart contracts into operational systems, bridges and software dependencies. Insurance providers must also determine whether broader protection can be offered without making premiums unaffordable.
