Crypto platforms have lost more than $3.63 billion to security incidents between January 2025 and July 2026. CoinGecko documented 245 attacks during the period.

The 10 largest incidents accounted for more than 72.5% of the total amount stolen, demonstrating that a relatively small number of major breaches drove most of the losses. Infrastructure and supply-chain vulnerabilities were the biggest sources of damage across both centralized exchanges and decentralized exchanges. Combined losses exceeded $1.8 billion.

Most Attacked Platforms Had Been Audited

Security failures involving Bybit and KelpDAO were notable examples. CoinGecko also found that the main weaknesses differ depending on how platforms are built.

For centralized exchanges, compromised private keys remained the most common point of failure, while decentralized applications lost $546 million through sophisticated smart contract exploits. Both centralized and decentralized platforms, however, remain exposed to oracle and market manipulation, with errors in internal mechanisms causing major losses for platforms including Bitget, Binance and Hyperliquid.

Upon examining the role of security checks, the report found that having an independent audit did not prevent many of the incidents. Of the 245 attacks recorded since early 2025, 147 involved protocols that had undergone audits before they were compromised. In fact, these audited platforms accounted for over 88% of the total capital drained during the 19-month period.

Conventional audits often do not cover the areas exploited in major attacks. Many incidents involved external infrastructure, unaudited code changes, or systemic features that were manipulated through governance attacks. Only about 11% of the incidents involving audited platforms were linked to smart contract vulnerabilities that fell within the audit scope, although those flaws still caused $396 million in losses.

CEXes generally do not use the same audit model as decentralized protocols and instead rely on compliance measures and financial attestations such as Proof-of-Reserve. However, CoinGecko said that such safeguards provide limited protection against social engineering and severe private-key security failures.

Crypto Insurance Is Shrinking

Even as exploits increased, active coverage across leading crypto insurance protocols has declined 20.2%, falling from $163.2 million to $130.2 million. Cumulative payouts have remained largely unchanged at $33 million. The report said high risks in the sector may have discouraged users from supplying capital or buying coverage at higher premium prices.

Crypto insurance can also have a narrow scope, as claims are often limited to verified smart contract exploits or infrastructure failures. Losses linked to human error, compromised private keys, or market volatility may not qualify.

As of August 2026, five of nine on-chain insurance protocols had become inactive or moved to other segments.

Source: CryptoPotato