Key Takeaways
- • Crypto platforms experienced 245 documented security incidents between January 2025 and July 2026, resulting in $3.63 billion in cumulative losses, with the largest 10 attacks accounting for 72.5% of all stolen funds.
- • H1 2026 saw 207 separate hacks generating $972 million in losses—less than half the $2.3 billion stolen in H1 2025—indicating declining per-incident damage despite sustained attack frequency.
- • Of 245 documented security incidents, 147 involved audited protocols accounting for 88.44% of stolen capital, yet only 11% of attacks exploited vulnerabilities within the audit's scope; most targeted infrastructure, third-party services, governance, front ends, or human error.
- • DEXs and decentralized applications suffered approximately $546 million in losses from smart-contract exploits, while infrastructure and supply-chain vulnerabilities—including third-party service weaknesses and integration failures—accounted for more than $1.8 billion in losses.
- • Crypto insurance coverage contracted to 20.2% of the market (declining from $163.2 million to $130.2 million in active coverage), while five of nine on-chain insurance protocols became inactive or pivoted by August 2026, leaving the sector underinsured despite escalating security risks.
Summary
The cryptocurrency sector faces a persistent security crisis despite widespread adoption of audited smart-contract protocols. According to CoinGecko's "2026's State of Crypto Security" report, the industry sustained $3.63 billion in losses across 245 documented security incidents between January 2025 and July 2026. While the frequency of attacks remains elevated—with 207 separate hacks recorded in H1 2026 alone—total losses have moderated considerably, dropping to $972 million in the first half of 2026 compared to $2.3 billion in H1 2025, suggesting that attackers are targeting smaller-value exploits despite maintaining attack velocity.
The concentration of damage remains severe: the largest 10 attacks accounted for 72.5% of all stolen funds, indicating that systemic risk is heavily concentrated among high-impact security breaches. Notably, 147 of the 245 documented incidents involved protocols that had undergone formal security audits, yet these audited platforms accounted for 88.44% of stolen capital. This counterintuitive finding reflects a critical gap in current security frameworks: only approximately 11% of attacks exploited vulnerabilities within the scope of formal audits, generating around $396 million in losses. The majority of successful attacks—approximately 89%—targeted areas outside traditional audit parameters, including infrastructure weaknesses, third-party service integrations, governance mechanisms, front-end vulnerabilities, and human error.
Decentralized exchanges and decentralized applications emerged as particularly vulnerable, with approximately $546 million lost to smart-contract exploits. However, the report reveals that infrastructure and supply-chain vulnerabilities have become the primary attack vector, accounting for more than $1.8 billion in losses. High-profile failures at platforms including Bybit and KelpDAO exemplify how breaches in third-party services, integrations, and software updates create systemic risk across the ecosystem.
The insurance sector has failed to scale in response to escalating threats. Active insurance coverage contracted to 20.2%, declining from $163.2 million to $130.2 million, while cumulative payouts remained approximately $33 million. More critically, five of nine on-chain insurance protocols became inactive or pivoted by August 2026, reducing the industry's capacity to absorb concentrated losses and leaving investors exposed to uninsured tail risks. This contraction in insurance availability coincides with the sector's persistent vulnerability to attacks outside formal audit scope, creating a compounding risk profile for institutional participants.
The concentration of damage remains severe: the largest 10 attacks accounted for 72.5% of all stolen funds, indicating that systemic risk is heavily concentrated among high-impact security breaches. Notably, 147 of the 245 documented incidents involved protocols that had undergone formal security audits, yet these audited platforms accounted for 88.44% of stolen capital. This counterintuitive finding reflects a critical gap in current security frameworks: only approximately 11% of attacks exploited vulnerabilities within the scope of formal audits, generating around $396 million in losses. The majority of successful attacks—approximately 89%—targeted areas outside traditional audit parameters, including infrastructure weaknesses, third-party service integrations, governance mechanisms, front-end vulnerabilities, and human error.
Decentralized exchanges and decentralized applications emerged as particularly vulnerable, with approximately $546 million lost to smart-contract exploits. However, the report reveals that infrastructure and supply-chain vulnerabilities have become the primary attack vector, accounting for more than $1.8 billion in losses. High-profile failures at platforms including Bybit and KelpDAO exemplify how breaches in third-party services, integrations, and software updates create systemic risk across the ecosystem.
The insurance sector has failed to scale in response to escalating threats. Active insurance coverage contracted to 20.2%, declining from $163.2 million to $130.2 million, while cumulative payouts remained approximately $33 million. More critically, five of nine on-chain insurance protocols became inactive or pivoted by August 2026, reducing the industry's capacity to absorb concentrated losses and leaving investors exposed to uninsured tail risks. This contraction in insurance availability coincides with the sector's persistent vulnerability to attacks outside formal audit scope, creating a compounding risk profile for institutional participants.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.