Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingCryptography platforms that have passed security audits still account for 88.44% of stolen funds.
According to CoinGecko's latest "Cryptography Security Status Report", between January 2025 and July 2026, of the US$3.63 billion stolen due to hacking attacks, encryption platforms that have passed independent security audits still account for 88.44%. The reason is not that the audit was negligent, but that the attack methods have shifted to areas that cannot be covered by the audit. Only 11% of security incidents during the same period involved vulnerabilities in audited smart contract code, resulting in losses of $396 million. The remaining loss of more than $1.8 billion resulted from infrastructure and supply chain attacks-including theft of private keys, tampering with front-ends, and breaches of management systems-aspects that Code Audit never touched.
The same problem is reflected in the disconnect between the so-called "fix" and the actual risk. This month, three Cosmos chains were suspended after attackers took advantage of a long-fixed vulnerability that should have been completely blocked months ago.
The attack on Bybit fully fits this pattern
Bybit's loss of $1.46 billion in February 2025-the single largest event in this data set-is the most direct example. According to Bybit's official accident timeline, the breach originated from malicious code being injected into the interface of Safe Wallet, a third-party wallet service its team used to sign transactions, rather than any flaws in Bybit's own system that had been audited. Security researchers linked the invasion to North Korea's Lazarus Group. The FBI's Internet Crime Complaint Center issued a public warning a few days later, confirming that the theft was committed by North Korea.
The same tactics are repeated in smaller cases. A signature flaw fixed in Ledger's Ethereum app this month allowed a malicious app to secretly replace a user's original transaction with another transaction while it was still displayed on the screen waiting for confirmation-this is the disconnect between what the user saw and what he actually signed.
Insurance is retreating as risks shift.
The report found that the effective underwriting amount of on-chain insurance agreements fell 20.2% from US$163.2 million to US$130.2 million. As of August 2026, five of the nine agreements it tracked had ceased operations or moved to other businesses. The cumulative compensation amount for the entire industry remains at US$33 million, with no growth.
Exchanges are filling the gap on their own rather than waiting for insurance payments. Bybit did not rely on insurance after the attack. It covered the funding gap within 72 hours through bridge loans and partner deposits obtained from institutions such as Galaxy Digital and Wintermute, and then worked with Tether and Circle to freeze stolen funds, recovering a further $42.89 million. However, not all platforms have such buffering capabilities. After an attack resulted in the theft of a quarter of its circulating supply, BounceBit directly shut down the entire blockchain and moved the holder to a snapshot state before the attack, so the stolen coins were not compensated.
This has led to a growing gap: a serious mismatch between where the funds are actually stolen and the direction the industry's defense focus is pointing. As long as audits remain focused on codes that are not the focus of losses and external insurance institutions continue to withdraw, the burden of covering the next major attack may fall on the exchange's own balance sheet-as Bybit experienced.
