Crypto Platforms Lose $3.6 Billion to Hacks Despite Security Audits

Hacks and theft cost cryptocurrency platforms over $3.6 billion in the last 18 months.

That’s according to recent findings by CoinGecko, cited in a report Tuesday (Sept. 8) by CNBC, which notes most of these incidents — the results of cyberattacks and stolen passkeys — happened despite the companies conducting security audits.

Roughly 88% of the stolen funds and about 60% of the affected platforms had “completed independent security audits,” the report said, though most of the attacks concentrated areas that checks do not usually cover.

The report focuses on the period of January 2025 to July of this year, and covers incidents such as the $1.4 billion theft in February 2025 from Bybit, the most affected company on the list, ahead of KelpDao ($292 million lost) and Drift Protocol ($285 million lost).

The latter two incidents were recently surpassed by the $320 million hack on the Liquid Network blockchain, a supposed “white hat” attack reported Sunday (Sept. 6).

The report’s timeframe also stopped before another recent high-profile incident, in which the breach of crypto wallets used by Coldcard customer led to the theft of at least $115 million in bitcoin.

“The prevalence of security breaches remains a persistent threat, even for vetted platforms,” the CoinGecko report said. “Out of 245 documented incidents since early 2025, 147 involved protocols that had undergone audits before being compromised. These vetted entities represented a staggering 88.44% of the total capital drained over the last 19 months.”

“Audit reports often fail to capture the full spectrum of risk. Most exploits on audited systems target external infrastructure, unaudited code updates, or systemic features manipulated via governance attacks. Surprisingly, only about 11.0% of these incidents involved in-scope smart contract flaws, though these still resulted in $396.0 million in losses.”

In related news, PYMNTS wrote last week about the advantages banks have in combatting authorized payment scams, as they can — potentially — see a victim funding crypto investment fraud before they can demonstrate that the payment is fraudulent.

“A retirement account is liquidated. Savings begin disappearing. A home equity line is opened. Personal loans are requested. Money moves between previously quiet accounts. Then comes the wire to a crypto exchange or unfamiliar beneficiary,” that report said. “Viewed individually, each transaction can look legitimate because the customer authorized it. Viewed as a sequence, the customer can look like they are liquidating their financial life to fund a scam.”