Crypto security losses hit $3.63 billion over 19-month stretch, CoinGecko finds
Security & Exploits ·
A new industry report tallies 245 breaches between January 2025 and July 2026 and shows most attackers sidestepped the very audits meant to catch them.
CoinGecko's 2026 Crypto Security Report puts total losses at $3.63 billion across 245 documented incidents spanning January 2025 through July 2026, according to a summary of the findings. Just ten attacks made up more than 72.5% of that stolen sum, underscoring how concentrated the damage was among a small number of large-scale hits rather than spread evenly across the sector.
The report's audit data complicates the assumption that a security review meaningfully reduces risk. About 60%, or 147, of the breached platforms had gone through independent audits beforehand, and those same platforms accounted for 88.44% of all losses. Yet only around 11% of the incidents involved flaws that fell within the technical scope auditors typically examine, meaning the overwhelming majority of exploited weaknesses sat outside what a standard smart contract review would have caught.
Insurance mechanisms meant to backstop such losses also contracted during the period. Active coverage capacity across onchain insurance protocols dropped 20.2%, sliding from $163.2 million to $130.2 million. That squeeze coincided with structural attrition in the sector itself: 5 of 9 onchain insurance protocols either shut down or shifted their business model, citing limited coverage and other constraints.
With dedicated onchain insurance shrinking, centralized exchanges have leaned more heavily on their own reserves, increasingly standing up self-funded investor protection funds rather than depending on third-party coverage to absorb potential losses. The report frames this as a shift in where risk ultimately lands when external insurance capacity fails to keep pace with the scale of incidents.
What remains unclear is whether the audit gap reflects a mismatch in scope, evolving attacker techniques, or both, and whether exchanges' self-funded reserves can scale fast enough to match losses of the size logged over the past 19 months. The report does not specify how CoinGecko projects insurance capacity or self-funded reserves will trend for the remainder of 2026.