Cryptocurrency platforms have lost more than $3.63 billion to cyberattacks and stolen access credentials between January 2025 and July 2026, highlighting persistent security weaknesses across the digital asset industry, according to a new CoinGecko report.
The crypto market data provider said in its State of Crypto Security Report 2026, published Aug. 27, that security audits failed to prevent many of the largest incidents recorded during the period.
CoinGecko found that approximately 88% of the stolen funds came from platforms that had completed independent security audits. Around 60% of the platforms affected by attacks had also undergone external security checks.
The findings suggest that traditional security audits may not adequately address some of the attack methods increasingly used against cryptocurrency platforms. According to the report, many incidents exploited vulnerabilities or operational risks that are typically outside the scope of standard security audits.
Bybit Hack Accounts for a Major Share of Losses
The largest loss during the period involved cryptocurrency exchange Bybit, which suffered a roughly $1.4 billion theft in February 2025.
Blockchain analytics firm Elliptic attributed the attack to North Korea, making it one of the largest cryptocurrency heists ever recorded.
CoinGecko ranked KelpDao as the second-largest victim, reporting losses of approximately $292 million, while Drift Protocol followed with about $285 million in losses.
The scale of these incidents underscores the growing risks faced by crypto platforms as attackers increasingly target digital assets, private keys and other critical access mechanisms.
Bybit, KelpDao and Drift Protocol had not immediately responded to requests for comment regarding the reported losses.
The report’s findings indicate that completing a security audit alone does not guarantee protection against sophisticated attacks. Crypto companies may need to combine audits with continuous monitoring, stronger access controls, operational safeguards and defenses against emerging attack techniques.
