Crypto Platforms Suffer Over $3.6 Billion in Security Breaches Since Early 2025
Cryptocurrency platforms have been hit by security incidents resulting in losses exceeding $3.63 billion between January 2025 and July 2026, according to a report by CoinGecko. The analysis documented a total of 245 attacks during this 19-month period.
Major Breaches Drive Significant Losses
The vast majority of these losses, over 72.5%, were concentrated in the 10 largest incidents, highlighting how a small number of major breaches have disproportionately impacted the total amount stolen. Vulnerabilities in infrastructure and supply chains proved to be the most damaging, affecting both centralized and decentralized exchanges and accounting for combined losses of more than $1.8 billion.
Notable security failures were observed at platforms including Bybit and KelpDAO. CoinGecko’s findings also indicate that the primary weaknesses vary depending on the platform’s architecture.
For centralized exchanges, compromised private keys were the most frequent cause of failure. Decentralized applications, on the other hand, lost $546 million due to sophisticated smart contract exploits. However, both types of platforms remain susceptible to oracle manipulation and market volatility, with internal mechanism errors leading to substantial losses for entities such as Bitget, Binance, and Hyperliquid.
Audits Fail to Prevent Majority of Exploits
The report also scrutinized the effectiveness of security checks, revealing that independent audits did not prevent a significant number of these incidents. Of the 245 attacks recorded since early 2025, 147 involved protocols that had undergone audits prior to being compromised. Alarmingly, these audited platforms were responsible for over 88% of the total capital drained during the period.
Conventional audits often overlook the specific areas exploited in major attacks. Many incidents stemmed from external infrastructure issues, unexamined code modifications, or systemic features manipulated through governance attacks. Only approximately 11% of incidents involving audited platforms were linked to smart contract vulnerabilities that were within the scope of the audit, though these flaws still resulted in $396 million in losses.
Centralized exchanges (CEXs) typically do not employ the same audit models as decentralized protocols. Instead, they rely on compliance measures and financial attestations like Proof-of-Reserve. CoinGecko noted, however, that these safeguards offer limited protection against social engineering tactics and severe private-key security failures.
Crypto Insurance Coverage Declines Amid Rising Risks
Despite the increase in exploits, active coverage across leading crypto insurance protocols has seen a decline of 20.2%, dropping from $163.2 million to $130.2 million. Cumulative payouts have remained relatively stable at $33 million. The report suggests that the high-risk environment in the sector may be deterring capital providers and discouraging users from purchasing coverage at elevated premium prices.
Furthermore, crypto insurance policies often have a limited scope, with claims frequently restricted to verified smart contract exploits or infrastructure failures. Losses attributed to human error, compromised private keys, or market volatility may not be eligible for coverage.
As of August 2026, five out of nine on-chain insurance protocols had ceased operations or shifted to different market segments.
Leave a Reply