Crypto sector lost $3.63 billion to hacks in a year and a half

The crypto sector lost over $3.63 billion to security incidents between January 2025 and July 2026. That is according to CoinGecko’s 2026 State of Crypto Security Report, which analysed 245 documented attacks. Notably, nearly 60% of affected platforms had undergone an independent security audit beforehand, and it was precisely those platforms that were responsible for the vast majority of the total damage.

At a glance:

• Over a one-and-a-half-year period, 245 crypto hacks resulted in total losses of $3.63 billion.
• The ten largest attacks together accounted for more than 72.5% of all stolen funds.
• More than 88% of the damage affected platforms that had been audited beforehand.

Audits offer no guarantee against hacks

Of the affected platforms, approximately 60%, or 147 of the 245, had undergone an independent security review before the attack took place. Yet these platforms were responsible for 88.44% of the total damage. That seems contradictory, but CoinGecko explains this by noting that most attacks fell outside the scope of the audit.

Only about 11% of the incidents involved vulnerabilities that would fall within the standard scope of a smart contract audit. In other words, audits do not typically check for the attack methods that are most frequently used.

The charts in the report show that supply chain attacks, at $1,806 billion, are by far the largest source of damage. Smart contract exploits are responsible for $777 million in losses, followed by attacks in which private keys are stolen ($431 million) and social engineering ($311 million).

Number of attacks increases sharply in 2026

The number of incidents per month shows a clear upward trend as the period progresses. In the first half of 2025, the number of attacks fluctuated between six and fourteen per month. In May and June 2026, 33 and 32 incidents were recorded respectively, a considerable portion of which concerned unaudited protocols.

Notably, audited protocols are also being affected more frequently in absolute numbers. In June 2026, there were 23 attacks on audited platforms, compared with 9 on unaudited ones. This pattern confirms that an audit in itself does not provide sufficient protection.

Blockchain insurance coverage shrinks

While the damage mounts, the available insurance coverage through blockchain protocols is actually declining. The active coverage capacity of so-called onchain insurance protocols fell by 20.2%, from $163.2 million to $130.2 million. Five of the nine existing protocols have since ceased operations or revamped their activities.

Centralised exchanges are responding to this by increasingly setting up their own protection funds to compensate affected users. Whether that is enough to restore confidence is a question that also keeps regulators busy, as rules on the custody of crypto assets come under scrutiny.

CoinGecko’s findings tie into a broader discussion about security in the sector, which, despite record amounts of new investment in crypto startups, continues to struggle with structural vulnerabilities.