Crypto Audits Miss the Risks Behind $3.63B in Security Losses
Crypto platforms lost $3.63 billion across 245 documented security incidents between January 2025 and July 2026, but the scale of the losses is only part of the problem.
Summary:
- Crypto platforms lost more than $3.63 billion across 245 incidents since the start of 2025.
- Infrastructure and supply-chain failures caused more damage than smart-contract exploits.
- Audited platforms accounted for 88.44% of the capital stolen.
- On-chain insurance coverage has contracted even as security losses have increased.
CoinGecko’s 2026 State of Crypto Security Report finds that many of the largest breaches occurred at platforms that had already undergone independent audits, exposing a growing mismatch between how crypto projects demonstrate security and where attackers are actually finding vulnerabilities.
The concentration of losses is particularly striking. The 10 largest incidents accounted for more than 72.5% of all capital stolen during the period, meaning a relatively small number of failures caused most of the industry’s financial damage.
Crypto’s Largest Losses Are Moving Outside Smart Contracts
Smart-contract vulnerabilities remain a serious threat, but CoinGecko’s data suggests they are no longer sufficient for understanding the industry’s largest security failures.
More than $1.8 billion was lost through infrastructure and supply-chain vulnerabilities affecting centralized and decentralized platforms. By comparison, sophisticated smart-contract exploits drained approximately $546 million from decentralized applications. Separate research from TRM Labs points in the same direction: infrastructure and operational compromises represented only about 15% of incidents in H1 2026 but accounted for roughly 76% of funds stolen, indicating that the costliest attacks are increasingly concentrated outside smart-contract code..
That difference changes the security equation.
For a decentralized protocol, developers can audit contract logic, test edge cases and formally verify certain components. None of those measures necessarily protects the organization if an attacker compromises a private key, infiltrates a development dependency, manipulates an external interface or gains access to operational infrastructure.
Centralized exchanges face a different version of the same problem. CoinGecko identifies private-key compromise as their most prevalent point of failure, while Proof-of-Reserve attestations and traditional compliance controls offer little direct protection against stolen signing credentials or successful social-engineering attacks.
Security therefore increasingly depends on the systems surrounding blockchain code, not only the code itself.
The Audit Paradox: 60% Were Audited, Yet They Lost Most of the Money
The strongest finding in CoinGecko’s report concerns platforms that had already undergone independent security reviews.
Of the 245 documented incidents, 147 affected previously audited platforms. That means roughly 60% of compromised projects had completed an independent audit before the attack. More significantly, those platforms accounted for 88.44% of all capital stolen during the 19-month period.
Those numbers should not be interpreted as evidence that audits are ineffective. They reveal something more specific about their limits.
Only around 11% of incidents involving audited platforms originated from smart-contract vulnerabilities that were actually within the audit’s scope. Those failures still produced approximately $396 million in losses, but most successful attacks came through areas the conventional audit was never designed to certify.
- 147 of 245 exploited platforms had undergone an independent security audit.
- 88.44% of stolen capital came from those previously audited platforms.
- Only about 11% of their incidents involved in-scope smart-contract vulnerabilities.
- $396 million was nevertheless lost through those in-scope contract failures.
- Other breaches targeted external infrastructure, unaudited updates and governance mechanisms, according to CoinGecko.
The distinction matters for users evaluating a protocol. An audit badge can provide evidence that a specific version of a smart contract was reviewed at a particular point in time. It cannot establish that the project’s entire operational environment is secure.
That gap becomes larger as protocols become more complicated.
READ MORE: Term Labs Exploit Shows How Governance Can Become a Liability
Modern crypto applications can depend on front ends, bridges, governance systems, multisignature wallets, oracles, external libraries and administrative privileges. Each dependency creates another potential route to assets that may sit outside the scope of the original contract review.
Why $3.63 Billion in Losses Does Not Mean 245 Equal Failures
The concentration of losses in only a handful of incidents creates another useful distinction.
With the top 10 attacks responsible for more than 72.5% of the $3.63 billion stolen, security risk is heavily skewed toward catastrophic events rather than evenly distributed across hundreds of exploits.
For exchanges and large protocols, that makes the potential severity of a breach at least as important as its probability.
A platform could successfully defend against dozens of lower-value attacks and still suffer an existential loss if one privileged key or critical infrastructure component is compromised. This is why security architecture increasingly relies on multiple controls, including restricted signing permissions, withdrawal monitoring, transaction limits and mechanisms capable of isolating compromised systems.
It also explains why infrastructure attacks deserve greater attention. A vulnerable smart contract may expose the funds controlled by that contract. Compromising privileged infrastructure can potentially give an attacker access to assets across a much wider portion of an organization’s operations.
Crypto Insurance Is Shrinking While the Attack Surface Expands
The industry’s insurance market might be expected to grow alongside those risks. CoinGecko found the opposite.
Active coverage among leading crypto insurance protocols declined 20.2%, from $163.2 million to $130.2 million, while cumulative payouts remained around $33 million. As of August 2026, five of the nine on-chain insurance protocols tracked by CoinGecko had either become inactive or pivoted into other businesses.
Part of the problem is what these products actually insure.
Coverage can be narrowly defined around verified smart-contract exploits or specified infrastructure failures. Losses resulting from compromised private keys, human error or events outside the policy’s definitions may not qualify for compensation.
That creates an awkward mismatch with the attack data. The industry’s largest security problem is increasingly distributed across operational infrastructure, credentials and external dependencies, while insurance products can remain limited to clearly defined technical events.
Capital providers face the same economics from the opposite side. Higher expected security risk requires higher premiums or more conservative underwriting, potentially making coverage less attractive precisely when the underlying risk is rising.
Exchanges Are Building Their Own Loss-Absorption Layer
Centralized exchanges have increasingly responded through another model: dedicated protection funds designed to compensate users after qualifying security incidents. CoinGecko identifies exchange-backed protection mechanisms as one of the major trends in its 2026 security review.
These funds solve a different problem from audits.
An audit attempts to reduce the probability of a vulnerability being exploited. A protection fund deals with the financial consequences after preventative controls have already failed.
Neither replaces the other.
The more relevant question for users is therefore no longer simply whether a platform has been audited. A fuller assessment includes what was audited, when the audit occurred, which components remained outside its scope, how privileged keys are controlled, whether upgrades receive new reviews and what financial resources exist if an attack succeeds.
CoinGecko’s next security dataset will be particularly useful for measuring whether that shift is occurring. If infrastructure and supply-chain incidents continue to dominate losses while the share attributable to in-scope contract flaws falls, the industry’s traditional reliance on smart-contract audits as its most visible security credential will become an increasingly incomplete measure of actual exposure.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Zdravkov
Reporter at CoinsPress
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 10,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
