Cryptocurrency platforms suffered $3.63 billion in losses across 245 documented security incidents between January 2025 and July 2026, according to CoinGecko’s 2026 State of Crypto Security Report published on Aug. 27. The ten largest attacks accounted for more than 72.5% of all recorded stolen funds, while infrastructure and supply-chain compromises were responsible for more than $1.8 billion in losses.
The largest incident was the February 2025 Bybit breach, with approximately $1.44 billion lost through compromised transaction-signing infrastructure. Other significant attacks included the $292 million KelpDAO breach, the $285 million Drift Protocol attack, and the $223 million Cetus exploit. CoinGecko noted that state-linked groups, including North Korean hacking units, extracted roughly $577 million through social engineering and bridge infrastructure compromises. Centralized exchanges faced their leading risk from private key compromises, while decentralized applications lost about $546 million to smart-contract exploits. Oracle manipulation and internal-mechanism failures also affected platforms including Bitget, Binance, and Hyperliquid.
Security audits showed limited preventive value: about 60% of exploited platforms had undergone independent audits, yet those projects represented 88.44% of total losses. Only around 11% of incidents involved vulnerabilities within routine smart-contract audit scopes, causing roughly $396 million in losses. Most attacks occurred outside audit scope through external infrastructure, unaudited code changes, compromised credentials, or governance weaknesses.
Onchain insurance capacity also declined. Active coverage across leading protocols fell 20.2% from $163.2 million to $130.2 million, while cumulative payouts remained near $33 million. Five of nine tracked insurance protocols had become inactive or shifted focus by August 2026. As a result, centralized exchanges are increasingly relying on self-funded investor-protection funds, though CoinGecko cautioned these are not equivalent to regulated insurance.
