Crypto platforms have lost $3.63 billion to 245 documented security incidents between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report. The troubling finding: 60% of the exploited platforms had completed independent security audits before suffering an attack, yet these audited platforms accounted for 88.44% of the total capital stolen during the period.

Why Do Security Audits Miss So Many Attacks?

The disconnect between audits and actual breaches reveals a fundamental mismatch in how the crypto industry approaches security. Traditional security audits focus narrowly on smart contract code, the automated programs that execute transactions on blockchains. However, most attacks in 2025 and 2026 occurred outside this scope entirely. Only around 11% of incidents involved smart contract vulnerabilities, meaning roughly 89% of attacks exploited weaknesses that audits typically don't catch.

The real vulnerabilities lie elsewhere. Many incidents involved external infrastructure, unaudited code changes, or systemic weaknesses exploited through governance attacks, where bad actors gain control of decision-making processes. Centralized exchanges face additional risks including social engineering, where attackers manipulate employees into revealing sensitive information, and private key compromises, where the cryptographic passwords that unlock wallets are stolen.

What Types of Attacks Are Costing the Most?

Supply chain attacks and key compromises emerged as the most damaging attack vectors in 2025 and 2026, resulting in more than $1.8 billion in losses across centralized exchanges (CEXs) and decentralized platforms. Centralized exchanges, which hold customer funds directly, face particular risk from private key theft. Decentralized applications (dApps), which operate without a central authority, are more vulnerable to sophisticated smart contract exploits and malicious integrations where fraudulent code is inserted into legitimate systems.

The attackers themselves have become more sophisticated. CoinGecko's report highlights a shift toward organized criminal groups and state-sponsored actors, including North Korean hacking groups. These adversaries use advanced obfuscation techniques, including mixers and bridges, to make tracking stolen funds significantly more difficult. Mixers are services that combine funds from multiple users to obscure their origin, while bridges are protocols that transfer assets between different blockchains.

How Are Crypto Insurance and Protection Funds Responding?

As security threats have intensified, the crypto insurance market has paradoxically contracted. Active coverage from leading on-chain insurance protocols declined 20.2%, falling from $163.2 million to $130.2 million. Meanwhile, cumulative payouts remained relatively unchanged at $33 million, suggesting that insurance providers are pulling back despite rising losses.

CoinGecko attributed the decline in coverage to elevated security risks and restrictive policy terms. Many policies exclude risks such as human error, compromised private keys, and market volatility, leaving users with gaps in protection. This has caused 5 out of 9 on-chain insurance protocols to either become inactive or shift their focus to other areas. In response, centralized exchanges are increasingly introducing protection funds designed to compensate users in case a security incident occurs, effectively replacing traditional crypto insurance.

Steps to Understand the Security Landscape Facing Crypto Users

• Supply Chain Vulnerabilities: More than $1.8 billion in losses came from infrastructure and supply chain attacks, including incidents at platforms like Bybit and KelpDAO, showing that even established platforms face risks from compromised dependencies and external systems.
• Oracle and Market Manipulation: Even renowned platforms including Bitget, Binance, and Hyperliquid fell prey to oracle attacks, where attackers manipulate price feeds that smart contracts rely on to execute trades, demonstrating that market-leading exchanges are not immune.
• Governance Attack Exposure: Decentralized exchanges and applications remain exposed to governance attacks where malicious actors gain voting control, as well as smart contract vulnerabilities that can be compounded by malicious integrations and fraudulent user interfaces.
• Insurance Coverage Gaps: The decline in active insurance coverage from $163.2 million to $130.2 million, combined with restrictive policy terms excluding human error and private key compromises, leaves users with limited recourse after incidents occur.

The CoinGecko report underscores a critical reality: security in crypto requires multiple layers of protection, and no single measure is sufficient. Traditional audits catch some problems but miss many others. Insurance coverage is shrinking even as losses mount. The industry's shift toward exchange-backed protection funds suggests that platforms themselves are taking on more responsibility for user security, but this approach lacks the standardization and transparency of formal insurance products.

For investors and users, the findings highlight the importance of understanding where their assets are held and what protections are actually in place. A platform's completion of a security audit should not be mistaken for comprehensive safety, and the absence of insurance coverage should factor into decisions about how much capital to expose to any single platform or protocol.