Audited Protocols Account for 88% of Crypto Hack Losses Since 2025, Report Shows

CoinGecko’s 2026 State of Crypto Security report reveals that independent security audits did not prevent the majority of crypto thefts. Of the 245 incidents tracked between January 2025 and July 2026, audited protocols were behind 88.44% of the $3.63 billion lost.

Audit Coverage vs. Actual Losses

Independent auditors had cleared 147 of the breached platforms before attackers accessed them. Only 11% of the exploits involved in‑scope smart‑contract flaws, yet those cases still accounted for $396 million in losses.

Where the Money Was Stolen

• Supply‑chain and infrastructure breaches: >$1.8 billion (largest category)
• Smart‑contract exploits in dApps: $546 million
• Centralized exchange private‑key compromises: most common failure point for CEXes

Notable Attacks

• Stake DAO breach – attacker compromised a deployer key rather than contract logic.
• Bybit theft – $1.5 billion loss, inflating 2025 totals.
• Kelp DAO – $292 million loss (2026).
• Drift Protocol – $285 million loss (April 2026).
• Term Labs governance exploit – $8.5 million loss (August 2026).

Trends in Incident Volume and Size

DefiLlama recorded 233 incidents in 2026 worth roughly $1.31 billion, compared with 92 incidents and $2.37 billion in 2025. While incident volume more than doubled, average loss per incident fell from $25.8 million to $5.6 million.

Insurance Landscape

Active on‑chain insurance coverage dropped 20.2% to $130.2 million, and five of nine insurance protocols either went inactive or changed direction.

Key Takeaway

The data suggests that audit focus remains narrow, while vulnerabilities in deployment keys, governance mechanisms, and external infrastructure present growing risk vectors.