Crypto protocols with completed security audits were breached in 147 of 245 incidents tracked through July 2026, according to CoinGecko's state of crypto security report. These audited platforms accounted for $3.22 billion of the $3.63 billion in total losses during the 19-month period.
Independent audits focused narrowly on smart contract logic. Only 11% of exploits involved in-scope flaws in audited code, resulting in $396 million in losses. The remaining 89% of attacks targeted vulnerabilities outside the scope of traditional security reviews.
Infrastructure Emerges as Primary Attack Vector
Supply chain and infrastructure breaches represented the largest category of losses, exceeding $1.8 billion. Attackers compromised deployer keys, accessed code deployed after audits concluded, and manipulated governance systems. On centralized exchanges, stolen private keys remained the most common failure point.
The May 2026 Stake DAO breach illustrated this pattern. An attacker obtained a deployer key rather than exploiting contract logic, draining funds despite the protocol's prior security review.
Smart contract exploits across decentralized applications reached $546 million, while total losses concentrated heavily among the largest incidents. The 10 largest attacks accounted for 72.5% of all funds stolen across the tracking period.
Insurance Coverage Declines Amid Rising Incidents
On-chain insurance protection weakened during this timeframe. Active insurance fell 20.2% to $130.2 million, and five of nine insurance protocols became inactive or pivoted their operations.
The pace and scale of attacks shifted in 2026. DefiLlama recorded 233 incidents worth $1.31 billion through mid-year, compared to 92 incidents totaling $2.37 billion during the same period in 2025. The average loss per incident declined from $25.8 million to $5.6 million, reflecting more frequent but smaller-scale breaches.
Kelp DAO lost $292 million and Drift Protocol lost $285 million in April 2026, ranking among the largest breaches since 2025. A governance exploit at Term Labs in August 2026 drained $8.5 million, exemplifying the smaller attacks now occurring regularly.
