Crypto Security Report: $3.63B Lost in 245 Attacks
CoinGecko’s Crypto Security Report found that cryptocurrency platforms lost more than $3.63 billion in 245 documented incidents from January 2025 to July 2026. The 10 largest attacks caused 72.5% of total losses, led by the $1.44 billion Bybit breach. Other major incidents involved KelpDAO, Drift Protocol and Cetus.
Infrastructure and supply-chain failures caused more than $1.8 billion in losses. Decentralised applications lost about $546 million through smart-contract exploits, while private-key compromise remained the leading risk for centralised exchanges. Oracle failures, market manipulation and internal system errors also affected platforms including Bitget, Binance and Hyperliquid.
The Crypto Security Report found that conventional audits provided limited protection. Audited platforms were linked to 147 incidents and 88.44% of losses, but only about 11% of all incidents involved vulnerabilities normally covered by smart-contract audits. External infrastructure, unaudited updates, governance and operational controls were more common attack routes.
Active coverage from major on-chain insurance protocols fell 20.2%, from $163.2 million to $130.2 million, while cumulative claims remained near $33 million. By August 2026, five of nine tracked protocols had shut down or pivoted. Centralised exchanges are increasingly relying on self-funded protection reserves, which are not equivalent to regulated insurance.
For traders, the findings highlight counterparty, custody, bridge and protocol risks. Exchange reserves, withdrawal controls, private-key management, audit scope and insurance terms remain important when assessing market exposure.
Neutral
The report is broadly negative for confidence in the crypto sector because large hacks, weak infrastructure controls and shrinking insurance coverage can increase risk premiums and trigger short-term selling after major breaches. Traders may also reduce exchange balances, avoid exposed protocols and demand higher returns for holding related tokens.
However, the report does not identify a new attack on a specific widely traded cryptocurrency, nor does it directly change token supply, demand or network fundamentals. The losses are cumulative, and some stolen assets may have been recovered or frozen. As a result, the immediate price impact on the wider cryptocurrency market is likely to be limited and sentiment-driven rather than a sustained market-wide decline. Longer term, stronger custody standards, better operational controls and more transparent protection funds could improve market resilience, while further incidents would create renewed bearish pressure.