Crypto platforms have lost over $3.63 billion to cyberattacks — even though most of them did security checks

• Traditional security reviews aren't enough to keep cryptocurrency platforms secure.
• Between January 2025 and July 2026, cryptocurrency platforms have lost more than $3.63 billion due to a variety of cyberattacks and stolen passkeys, CoinGecko said.
• The bulk of stolen funds and affected sites had undergone audits, the report said.

A man holds a laptop computer as cyber code is projected on him in this illustration picture taken on May 13, 2017.Kacper Pempel | Reuters

Security audits weren't enough to keep many cryptocurrency platforms safe from money-losing hacks, crypto market data site CoinGecko said in a report dated Aug. 27.

Between January 2025 and July 2026, cryptocurrency platforms have lost more than $3.63 billion due to a variety of cyberattacks and stolen passkeys, the report said.

Around 88% of the stolen funds and about 60% of the affected platforms had "completed independent security audits," the report said. It noted most of the attacks targeted areas that checks do not typically cover.

Bybit was most affected, the report said, citing the $1.4 billion February 2025 heist that Elliptic attributed to North Korea. Second-most affected was KelpDao, with $292 million lost, followed by Drift Protocol, with $285 million lost, the report said.

Bybit, KelpDao and Drift Protocol didn't immediately respond to a CNBC request for comment.

Choose CNBC as your preferred source on Google and never miss a moment from the most trusted name in business news.