CoinGecko reports $3.63B in crypto losses from Jan 2025 to mid-2026

Crypto security breaches cost the industry $3.63 billion between January 2025 and early August 2026, according to a new report from CoinGecko. Total losses since 2016 now exceed $14.27 billion, with the last 19 months accounting for roughly a quarter of that decade-long total, the data aggregator said.

The 2025 portion shows $2.55 billion lost across 97 incidents, averaging $26.3 million per breach. A single incident skewed that figure: the Bybit exchange breach, attributed to North Korean actors, accounted for $1.4 billion to $1.5 billion in losses. Excluding Bybit leaves roughly $1.1 billion across the remaining 96 incidents.

Data for 2026 covers just over seven months. Losses total about $1.2 billion, but the incident count has already reached 164, nearly 70% more than all of 2025. Average loss per incident in 2026 sits around $7.3 million, a fraction of 2025's inflated average.

One month stands out. April 2026 recorded over $644 million in losses, with incidents again linked to North Korean threat actors. April's total nearly matched the non-Bybit haul for all of 2025.

CoinGecko highlights the KelpDAO exploit as a case study. The attack exploited a vulnerability in a LayerZero bridge, and its consequences spread beyond the direct theft. Aave's total value locked dropped from about $25.9 billion to $14.4 billion in the aftermath, an $11.5 billion decline that dwarfed the initial exploit losses, CoinGecko said.

Secondary effects hit token prices. STEP and BONK both fell sharply after major incidents even though those tokens were not directly involved, the report found.

A qualitative shift is underway. Operational vulnerabilities, including governance attacks and private-key compromises, remain persistent and cannot be fully addressed by smart contract audits, CoinGecko said.

North Korean state-sponsored actors continue to feature prominently. The Bybit breach in 2025 and the April 2026 cluster both carry attribution to groups linked to Pyongyang.

The previous peak year for crypto losses was 2022, at $2.77 billion. The 2025 figure of $2.55 billion came close to matching it. Including Bybit, 2025 set a new record.

Incident frequency accelerated from 97 in 2025 to 164 in just over seven months of 2026, a pace that suggests the attack surface is expanding faster than the industry's ability to secure it, CoinGecko said.