Crypto hacks hit $3.63B since 2025 despite audited protocols
H1 2026 saw 207 crypto hacks with $972M stolen, less than half the 2025 total. But audited protocols accounted for 88% of losses since 2025, as insurance coverage shrank.
Almost eight months into 2026, the pace of crypto security incidents shows no sign of slowing. Attackers carried out 207 separate hacks in the first half alone, according to CoinGecko's '2026's State of Crypto Security' report. Total losses reached $972 million, less than half the $2.3 billion stolen during the same period a year earlier.
Between January 2025 and July 2026, the industry recorded 245 documented security incidents, with combined losses of $3.63 billion, the report said. The 10 largest attacks accounted for more than 72.5% of stolen funds.
Decentralized exchanges and dApps bore the brunt of smart-contract exploits, losing roughly $546 million to such attacks, CoinGecko found. Infrastructure and supply-chain vulnerabilities, weaknesses in third-party services, integrations, and updates, accounted for more than $1.8 billion in losses. High-profile case studies included the security failures at Bybit and KelpDAO.
Of the 245 incidents, 147 involved protocols that had undergone audits. Those audited platforms accounted for 88.44% of stolen capital. But only about 11% of those attacks targeted vulnerabilities within the audit's scope, causing around $396 million in losses, the report said. Most exploited areas outside the audit's reach: infrastructure, third-party services, governance, front ends, or human error.
Active insurance coverage has shrunk even as hacks mount. Total coverage fell to 20.2% of peak levels, dropping from $163.2 million to $130.2 million, while cumulative payouts stayed around $33 million. Five of nine on-chain insurance protocols have become inactive or pivoted away from the sector by August 2026, CoinGecko said.
The SEC is revisiting its Custody Rule to clarify who can safeguard customer crypto. On August 25, the agency submitted proposed amendments to OIRA for review, with publication expected by October 2026, followed by at least 60 days of public comment. The rules are not yet effective. A further analysis and a second SEC vote mean mandatory compliance could still take several years.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.