CoinGecko’s latest “State of Crypto Security Report” recorded the loss of $3.63 billion in user funds across 245 security incidents between January 2025 and July 2026. Released on August 27, 2026, the data revealed an anomaly: 147 targeted platforms, or roughly 60% of total victims, had completed independent security audits before being breached. This audited group accounted for 88.44% of the total value lost.
The limited scope of audits is evident from records showing that only 11% of incidents involved vulnerabilities within the scope of routine smart contract testing, accounting for $396 million in losses. Security audits essentially capture only a snapshot of a specific code version at a single point in time, and subsequent code changes made by developers after the audit concludes can introduce new vulnerabilities.
Infrastructure Attacks Account for the Largest Share
The top ten incidents accounted for more than 72.5% of all stolen funds. Infrastructure and supply chain attacks led the way, with total losses exceeding $1.8 billion. These types of exploits target operational control hubs rather than smart contract code on the blockchain.
The single most damaging incident hit the exchange Bybit in February 2025. Hackers drained approximately $1.44 billion by infiltrating transaction-signing infrastructure, without exploiting a single smart contract flaw. Private key compromises remain the primary security risk for centralized crypto exchanges (CEXs).
North Korean hackers siphoned approximately $577 million through bridge infrastructure hacks and social engineering techniques. On the opposite side of the ecosystem, decentralized applications (DApps) recorded $546 million in losses from direct smart contract exploits, an ever-present top threat in the DApp sector.
Crypto Insurance Sector Continues to Shrink
Active insurance coverage capacity across the DeFi space stood at $130.2 million. This point-in-time protection figure is minuscule when compared against the $3.63 billion in cumulative losses.
Crypto insurance providers also appear to struggle with business viability. Of the nine protocols tracked by CoinGecko, five were either inactive or forced to pivot their business models as of August 2026. Soaring risk levels and steep premium costs are steadily eroding alternative protection options for both crypto users and platform builders. Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
