Report: 88% of Crypto Hack Losses Since 2025 Hit Audited Protocols

Since January 2025, crypto protocols that had completed independent security audits accounted for 88.44% of all stolen funds, according to CoinGecko's 2026 state of crypto security report.

The study tracked 245 incidents and $3.63 billion in losses through July 2026. Among the compromised platforms, 147 had been cleared by independent auditors before attackers struck.

Security Audits Failed to Prevent 147 of 245 Crypto Hacks

Only 11% of exploits involved smart contract flaws within the audit scope, CoinGecko noted, but those cases still drained $396 million.

The rest of the damage came from other vectors. Attackers went after external infrastructure, code deployed after the audit, and systemic features that could be manipulated via governance.

Supply chain and infrastructure breaches took more than $1.8 billion, the largest single category in the report. Overall, smart contract exploit-driven losses across decentralized applications (dApps) reached $546 million.

The Stake DAO breach in May showed the limit. Rather than exploiting contract logic, an attacker compromised a deployer key. On centralized exchanges, stolen private keys remained the most common failure point.

“Infrastructure and supply chain vulnerabilities have proven to be the most devastating for both CEXes and DEXes,” the report stated.

Losses were highly concentrated. The 10 largest attacks alone produced 72.5% of everything stolen across the 19-month window.

Coverage for those losses is also shrinking. Active on-chain insurance fell 20.2% to $130.2 million, and five of nine insurance protocols either went inactive or shifted focus.

2026 Sees More Hacks but Smaller Losses

Meanwhile, DefiLlama has logged 233 separate incidents so far in 2026, worth roughly $1.31 billion. The same stretch of 2025 saw 92 incidents and $2.37 billion in losses.

Incident volume more than doubled while total losses fell about 45%. The average loss per incident dropped from $25.8 million to $5.6 million. The $1.5 billion Bybit theft inflated the 2025 total.

Three cases carried most of this year’s total. Kelp DAO lost $292 million, and Drift Protocol lost $285 million in April 2026. These two also rank among the top three hacks since 2025, after Bybit.

Smaller attacks now occur quite frequently, adding to the long list of 2026 crypto breaches. August alone brought an $8.5 million Term Labs governance exploit.

Overall, the pattern raises a scoping question rather than a competence one. Contract reviews remain narrow while deployment keys and governance parameters carry growing value.