Cryptocurrency platforms suffered $3.63 billion in losses across 245 theft incidents between January 2025 and July 2026, according to CoinGecko's State of Crypto Security Report 2026. Infrastructure vulnerabilities accounted for $1.8 billion of the total.
The $1.8 billion in infrastructure-related breaches represents nearly half of all losses during the period. CoinGecko categorizes these as supply-chain and systems-level compromises distinct from theft vectors targeting user deposits or custodial holdings directly. Infrastructure breaches and systems compromises account for $1.8 billion across the 245 incidents.
The 245 incidents over 19 months averages to roughly 13 thefts per month across the sector. CoinGecko's report captures losses from exchange breaches, protocol vulnerabilities, bridge exploits, and custodial failures. The $3.63 billion total includes both confirmed on-chain theft amounts and platform estimates of missing funds where transaction records are incomplete.
Infrastructure breaches have repeatedly cost platforms eight and nine figures apiece. Cross-chain bridges have been a persistent target; multiple bridge exploits in 2025 and early 2026 each resulted in losses exceeding $100 million. Platform hot wallets and key management systems have also been compromised, leading to direct fund seizures before platform discovery.
The frequency of incidents reflects both the expanding attack surface as more platforms launch and the continued effectiveness of social engineering, phishing campaigns, and supply-chain compromise against development and operations teams. No single quarter showed a material decline in incident count during the 19-month window.
The $3.63 billion in confirmed losses represents approximately 0.8 percent of the roughly $450 billion in total crypto market capitalization as of August 2026. Platforms have responded by increasing insurance products, moving assets to cold storage, and adopting multi-signature approval processes. The CoinGecko report does not distinguish between recovered and unrecovered funds.
If infrastructure losses remain at $1.8 billion relative to total theft in the next 12-month reporting period, platform hardening efforts will have failed to outpace attack sophistication. The number to watch is whether the infrastructure loss share declines in CoinGecko's 2027 security report.
