Crypto platforms bled $3.63 billion across 245 documented security incidents from January 2025 to July 2026, according to CoinGecko's State of Crypto Security Report 2026.

The ten largest attacks alone accounted for 72.5 percent of total losses, concentrating risk in high-value targets. Infrastructure and supply chain vulnerabilities drove the majority of damage, totaling over $1.8 billion—attacks that exploited weaknesses in underlying systems and third-party services rather than core smart contract code.

KelpDAO's restaking protocol suffered a $293 million loss on April 19, 2026. Cetus Protocol lost $223 million, and Balancer was hit for $128 million. These incidents expose the compounding risks in complex DeFi composability and infrastructure dependencies.

Traditional security audits failed to prevent significant losses. Of 245 attacks, 147 targeted protocols that had already undergone independent audits. Those audited projects accounted for 88.44 percent of all stolen funds.

Only 11 percent of attacks exploited smart contract vulnerabilities typically covered by standard audits. The majority stemmed from external infrastructure failures, unaudited code updates, governance issues, or social engineering. A security audit no longer guarantees protection against private key compromises, infrastructure attacks, or systemic risks beyond audited code.

On-chain insurance coverage collapsed during this period. Active coverage across leading crypto insurance protocols declined 20.2 percent, falling from $163.2 million to $130.2 million. Aggregate payouts from these protocols reached roughly $33 million—a fraction of total losses. Five of nine active protocols either shut down or abandoned coverage as high market risk eroded both capital availability and demand for policies priced to reflect that risk.

Centralized exchanges moved to fill the gap. Binance's Secure Asset Fund for Users (SAFU), OKX's Risk Shield, and Kraken's Insurance Fund now serve as primary compensation mechanisms for users affected by incidents.

The 2025 calendar year recorded $3.3 billion in losses according to CertiK, over $4 billion per Global Ledger, and $3.4 billion from January through early December 2025 per Chainalysis's 2026 Crypto Crime Report.