Crypto hacks cost $3.63 billion in 19 months, CoinGecko report shows

CoinGecko’s State of Crypto Security Report, released on August 27, details $3.63 billion in losses from 245 documented security incidents between January 2025 and July 2026. The data highlights a concentration of losses in a handful of large attacks and underscores the limited protection offered by routine smart‑contract audits.

Loss concentration and major breaches

The ten largest incidents accounted for more than 72.5 % of the total stolen value. The biggest breach was the February 2025 Bybit attack, which alone resulted in an estimated $1.44 billion loss due to compromised transaction‑signing infrastructure. Other notable incidents included a $292 million breach of KelpDAO, a $285 million attack on Drift Protocol, and a $223 million exploit of Cetus.

Audit coverage versus actual risk

Only about 11 % of the incidents involved vulnerabilities that fell within the scope of routine smart‑contract audits, yet those in‑scope failures still caused roughly $396 million in losses. Platforms that had completed independent security audits represented 60 % of the affected entities but accounted for 88.44 % of the reported losses.

Primary risk vectors

• Private‑key compromises were identified as the leading risk for centralized exchanges.
• Infrastructure and supply‑chain attacks caused over $1.8 billion in losses, targeting private keys, employee devices, front‑end interfaces, software dependencies and bridge operators.
• Decentralized applications suffered approximately $546 million in losses from smart‑contract exploits, alongside oracle manipulation and internal‑mechanism failures.
• State‑backed groups, including North Korea‑linked actors, drained about $577 million through social engineering and bridge compromises.

On‑chain insurance and self‑funded reserves

Active on‑chain insurance coverage fell 20.2 % to $130.2 million, with cumulative payouts near $33 million. Five of the nine tracked protocols became inactive or pivoted by August 2026, reflecting heightened risk and premium costs.

Centralized exchanges are increasingly relying on self‑funded investor‑protection reserves rather than external insurance. While these reserves can enable faster reimbursements, they do not provide the same regulatory guarantees as formal insurance policies.

Outlook

The report suggests that future security improvements will require expanding audit scopes beyond smart contracts to include operational systems, bridges, and software dependencies, as well as developing more comprehensive insurance solutions.