Crypto platforms lost $3.63 billion across 245 documented security incidents between January 2025 and July 2026, according to CoinGecko's State of Crypto Security Report. The ten largest attacks accounted for more than 72.5% of all stolen funds, and only about 11% of incidents involved flaws within the scope of routine smart-contract audits.
Crypto platforms lost $3.63 billion across 245 documented security incidents between January 2025 and July 2026, CoinGecko said in its State of Crypto Security Report published Aug. 27. Losses were heavily concentrated: the ten largest attacks accounted for more than 72.5% of the total stolen value, while infrastructure and supply-chain compromises caused more than $1.8 billion in losses.
Bybit breach leads a list of nine-figure attacks
The February 2025 Bybit breach was the largest incident in the dataset, accounting for approximately $1.44 billion. Attackers compromised the exchange's transaction-signing infrastructure rather than exploiting a defect in a smart contract.
Other major incidents included the $292 million KelpDAO breach, the $285 million Drift Protocol attack and the $223 million Cetus exploit. State-backed groups also ran longer, more complex operations: two North Korea-linked attacks drained approximately $577 million through social engineering and bridge infrastructure compromises rather than ordinary contract flaws.
Audits caught only a fraction of exploited flaws
CoinGecko found that 147 of the 245 affected platforms, or about 60%, had completed an independent security audit before they were attacked. Those audited platforms accounted for 88.44% of recorded losses.
Yet only about 11% of incidents involved flaws within the scope of routine smart-contract audits, CoinGecko reported. Those in-scope failures still caused about $396 million in losses.
In related coverage, Ripple's security review identified 96 issues before affected code reached users, showing a smart-contract audit can prevent losses when findings arrive before code goes live. It cannot replace continuous monitoring and operational security.
Insurance coverage shrinks as attacks continue
Active coverage across major onchain insurance protocols fell 20.2%, from $163.2 million to $130.2 million, while cumulative payouts stayed near $33 million. Five of the nine protocols CoinGecko tracked had become inactive or moved into other business areas by August 2026.
Exchanges have increasingly built self-funded investor-protection funds instead of buying full external insurance, but coverage still depends on the exchange's own terms and reserve custody.
Source: CoinGecko
Trading involves risk.
Risk Disclaimer
