Crypto platforms lost more than $3.63 billion to security exploits between January 2025 and July 2026, according to data compiled by CoinGecko. The analysis documented 245 separate attacks during the 19-month period, with the 10 largest incidents accounting for over 72% of total losses.
Infrastructure and supply-chain vulnerabilities emerged as the leading sources of damage across both centralized and decentralized exchanges, with combined losses exceeding $1.8 billion. Decentralized applications suffered $546 million in losses primarily through smart contract exploits, while both platform types remained exposed to oracle manipulation and internal mechanism failures affecting platforms including Bitget, Binance, and Hyperliquid.
Security Audits Offered Limited Protection
A notable finding challenged assumptions about the protective value of security audits. Of the 245 recorded attacks, 147 involved protocols that had undergone independent audits before being compromised. These audited platforms accounted for over 88% of the total capital drained.
CoinGecko attributed this gap to the limited scope of conventional audits. Only about 11% of incidents involving audited platforms were linked to smart contract vulnerabilities that fell within audit scope, though those flaws still caused $396 million in losses. Many major exploits instead involved external infrastructure, unaudited code changes, or governance attacks that fell outside typical audit parameters.
For centralized exchanges, compromised private keys remained the most common point of failure. Centralized platforms generally rely on compliance measures and financial attestations such as Proof-of-Reserve rather than smart contract audits, though CoinGecko noted these safeguards offer limited protection against social engineering and severe private-key security failures.
Insurance Coverage Declines Amid Rising Risk
As exploit frequency increased, active crypto insurance coverage contracted significantly. Coverage across leading on-chain insurance protocols declined 20.2%, falling from $163.2 million to $130.2 million, while cumulative payouts remained largely unchanged at $33 million.
The report noted that insurance policies typically carry narrow scopes, with claims often limited to verified smart contract exploits or infrastructure failures. Losses tied to human error, compromised private keys, or market volatility generally do not qualify for coverage. As of August 2026, five of nine on-chain insurance protocols had become inactive or transitioned to other business segments.
