Crypto loses $3.63bn to hacks as audits prove far from foolproof

The crypto sector lost a total of approximately $3.63 billion to hacks and other security incidents between January 2025 and July 2026. According to CoinGecko’s Crypto Security Report 2026, 245 incidents took place during this period. Strikingly, around 60% of the affected projects had undergone an independent security audit beforehand. Yet these very projects are responsible for the vast majority of the financial damage.

Biggest hacks cause most of the damage

Losses are heavily concentrated among a relatively small number of incidents. Together, the ten largest attacks account for more than 72.5% of all stolen cryptocurrency.

CoinGecko’s data also shows that supply chain attacks cause by far the greatest damage. This category accounts for roughly $1.81 billion in losses, followed by smart contract exploits at around $777 million.

Attacks that compromise private keys caused around $431 million in damage. Social engineering, according to the chart, accounts for a further $311 million. Other attack methods, including oracle manipulation, access control issues, flash loan attacks and governance attacks, make up a smaller share of the total.

This makes clear that security problems do not lie only in the smart contracts themselves. Attackers also target infrastructure, staff, private keys and other components surrounding a protocol.

60% of hacked projects had prior audits

A striking element of the research concerns security audits. Of the 245 affected platforms, 147 had undergone an independent audit in advance, or roughly 60% of the total.

These audited projects are together responsible for 88.44% of all financial losses. That does not automatically mean audits are useless. According to CoinGecko, the majority of actual attacks fall outside the original scope of such a review.

Only about 11% of incidents involve vulnerabilities that fall within the usual scope of a smart contract audit.

The second chart, meanwhile, shows that both audited and non-audited protocols fall victim. Monthly incident numbers rise sharply, particularly in the spring of 2026.

On-chain insurance under pressure

At the same time, the on-chain insurance market is under pressure. The active capacity these protocols can use to cover risks has fallen by 20.2%, from $163.2 million to $130.2 million.

Limited coverage and other problems have led five of the nine on-chain insurance protocols studied to shut down or shift their operations.

As a result, centralised crypto exchanges are increasingly turning to their own funds to protect users during major incidents. Above all, the figures show how difficult it remains to fully secure billions of dollars in cryptocurrency. An audit can reduce certain technical risks, but it does not guarantee protection against hacks that occur through other attack routes.