Crypto platforms lost $3.63 billion to cyberattacks between January 2025 and July 2026, according to a CoinGecko report, which said roughly 60% of the affected platforms had completed independent security audits before the attacks.

CoinGecko said there were 245 attacks during the period, and that the top 10 incidents made up 72.5% of total losses. Among platforms that had already undergone audits, 147 protocols were later attacked, representing 88.44% of total losses in the dataset.

The report draws a distinction between audited code and broader security failures. Only about 11% of incidents were directly caused by flaws in audited smart contracts, with those losses totaling $396 million. That leaves most losses linked to other attack vectors not prevented by a standard code review.

Bybit was identified as the single largest case in the period after suffering a $1.4 billion theft in February 2025. CoinGecko also said centralized exchanges showed private key theft as a major weakness, while decentralized applications posted heavy losses from smart contract flaws.

The report also pointed to weaker insurance support during the period of continued attacks. It said crypto insurance coverage fell 20.2%, and that by August 2026, five of nine on-chain insurance protocols had either shut down or shifted to other sectors.

Why It Matters

The findings matter because they challenge a common market assumption that an audit meaningfully lowers overall breach risk on its own. The data suggests that crypto security remains heavily exposed to failures outside audited code, especially in areas such as private key protection and operational controls.

The insurance figures add a broader market-structure concern. If coverage continues to shrink while losses remain concentrated in a small number of very large incidents, projects, exchanges, and users could face a thinner backstop after security failures, increasing pressure on prevention rather than post-incident protection.