Crypto platforms lost $3.63 billion across 245 exploits since January 2025. CoinGecko’s 2026 report highlights the changing risks facing the industry.
Supply-chain attacks were the largest source of losses during the period, accounting for about $1.81 billion. The Bybit and KelpDAO incidents were among the biggest examples of how weaknesses outside a core smart contract can lead to major losses.
The attack surface also differs between centralized and decentralized platforms.
CEXs remain particularly exposed to private key compromises, while decentralized applications face greater risks from smart contract vulnerabilities. Smart contract exploits accounted for roughly $777 million in losses, according to the report.
Other attack vectors, including private key compromises, social engineering, oracle manipulation and governance attacks, continue to add to the threat.
One of the report’s most notable findings is that having an audit does not necessarily prevent a crypto hack.
Of the 245 documented incidents, 147 affected protocols that had undergone an independent security audit. These platforms accounted for 88.44% of the capital lost during the period.
However, this does not mean audits are ineffective. Instead, many attacks occurred outside the specific code and risks examined during an audit.
Only around 11% of incidents involving audited platforms were linked to in-scope smart contract vulnerabilities. Attackers also targeted infrastructure, later code changes, governance mechanisms and human weaknesses.
This creates a wider security challenge for crypto platforms. A clean audit can reduce certain technical risks, but it cannot protect against every possible failure.
Crypto insurance has also struggled to keep pace with rising losses.
Active coverage across leading on-chain insurance protocols fell 20.2%, from $163.2 million to $130.2 million, despite the growing number of exploits. At the same time, cumulative payouts remained around $33 million.
Coverage can also come with strict conditions. Policies may only cover specific smart contract or infrastructure failures, leaving some losses involving compromised private keys, human error or market movements outside the protection.
By August 2026, five of the nine tracked on-chain insurance protocols had become inactive or shifted toward other areas, showing the difficulty of building a sustainable crypto insurance market.
Centralized exchanges are increasingly turning to dedicated protection funds to provide an additional safety net for users.
The CoinGecko report highlights several exchange-backed funds, including:
These reserves are designed to help cover losses linked to platform-related incidents. Some exchanges also publish wallet addresses or reserve information so users can monitor the funds on-chain.
Protection funds do not eliminate the risk of an exchange hack, but they can provide an additional layer between a security incident and customer losses.
The biggest takeaway from the 2026 security report is that crypto security is no longer just a smart contract problem.
Attackers are targeting the broader ecosystem, including wallets, infrastructure, governance systems, third-party integrations and human operators. This makes security audits important, but not sufficient on their own.
For users, exchange protection funds, transparent reserves, independent audits and strong custody practices can all reduce risk. For protocols, the challenge is building security processes that continue after an audit rather than treating an audit as the final checkpoint.
With billions already lost since the start of 2025, the next phase of crypto security will likely focus on protecting the entire technology stack rather than a single piece of code.
Read more: 2026 State of Crypto Security Report
Everstake's review of 15 ETH treasury companies found $1.41 billion in FY2025 net losses, with staking making up 60% of revenue on average at six firms.
A Bitquery audit found Polymarket's primary favorites won 87% of 273 races, yet a dollar on each lost 4 cents. The losses came from the mid-priced favorites.
Citrini Research's report names Securitize, Coinbase, Circle, Aerodrome, Aave and Ondo as tokenization winners, and says fees matter more than activity.
