Crypto platforms lose $3.63B to hacks

TLDR

A new CoinGecko report finds that crypto platforms lost about $3.63 billion to hacks between January 2025 and July 2026, even when many had passed security audits.

1. The $3.63 billion figure covers major incidents like the reported $1.4 billion Bybit hack and large exploits on KelpDao and Drift Protocol over an 18 month window.
2. Around 88% of stolen funds and roughly 60% of hacked platforms were audited, but attackers hit operational weak spots that audits usually miss, often using stolen passkeys.
3. For users, the main defenses are better custody choices and basic opsec, while platforms face rising pressure to harden key management, bridge infrastructure, and monitoring.

Deep Dive

1. Scope Of The Losses

CoinGeckos latest security report, summarized by outlets like CNBC and Yahoo Finance, estimates that cryptocurrency platforms lost about $3.63 billion to cyberattacks from January 2025 to July 2026.

The largest single incident was a February 2025 hack of exchange Bybit, which reportedly cost about $1.4 billion, with staking platform KelpDao losing around $292 million and decentralized exchange Drift Protocol about $285 million in separate exploits.

These numbers cover a mix of centralized exchanges, DeFi protocols and cross chain infrastructure, showing that risk is not confined to one part of the ecosystem.

2. Why Audits Did Not Stop These Hacks

CoinGecko notes that about 88% of the stolen funds and around 60% of the affected platforms had completed independent security audits before they were hacked. Their report says most attacks targeted areas that typical audits do not deeply cover, such as passkey security, operational processes and supporting infrastructure rather than only smart contract code.

Many incidents relied on stolen or abused credentials, misconfigured systems, or weaknesses in bridges and custody layers, not failures of the base blockchains. Several large hacks, including the Bybit incident, have been linked by analysts and regulators to North Korean state backed actors, who specialize in social engineering and complex exploit chains.

3. How Users And Platforms Can Respond

For everyday users, the main levers are where and how they hold assets. Splitting funds between reputable custodial platforms and well secured non custodial wallets, enabling strong two factor authentication and being cautious of phishing links materially reduces risk.

Institutions and platforms need deeper defenses than a one time audit. That includes strict key management and access controls, real time anomaly detection, red team testing, hardened bridge and cross chain infrastructure, and clear incident response plans, plus insurance where feasible.

Regulators and large investors are likely to keep raising the bar, so venues that can show strong security practices and transparent post mortems after incidents may have an advantage over time.

Conclusion

The $3.63 billion loss figure underlines that cryptos biggest security problems now sit at the platform and infrastructure layers, not the underlying chains.

For users, the practical takeaway is to treat audits and brand names as partial signals, not guarantees, and to focus on custody choices and basic operational security.

For platforms, competing for capital increasingly means competing on security, with better key management, monitoring and incident handling becoming as important as new listings or features.