According to a CoinGecko report, cryptocurrency platforms lost $3,6 billion to cyberattacks and stolen passkeys between January 2025 and July 2026. Despite undergoing independent security audits, 60% of the affected platforms suffered these breaches, accounting for 88% of the total stolen funds.
The data shows 245 documented incidents during this period. Of these, 147 involved protocols that had completed audits prior to being compromised. These vetted entities represented 88,44% of the total capital lost. Only 11% of incidents involved smart contract flaws, which resulted in losses of $396 million.
Bybit was the most affected company with a loss of $1,4 billion in February 2025. Other significant losses included KelpDao with $292 million and Drift Protocol with $285 million. Additionally, the Liquid Network blockchain experienced a hack amounting to $320 million in September 2026.
The report notes that security audits often fail to cover external infrastructure, unaudited code updates, or governance-based systemic manipulations. Furthermore, a separate breach involving Coldcard customer wallets led to the theft of at least $115 million in bitcoin, occurring outside the report's primary timeframe.
