Why Audited Crypto Protocols Are Still Losing Billions to Security Breaches
According to a CoinGecko report covered by Cryptonews.net, between January 2025 and July 2026 crypto platforms absorbed 245 documented security incidents totaling $3.63 billion in losses — even as audit coverage expanded across the industry.
For protocol architects, the headline number obscures a more uncomfortable finding: audited code is rarely where the breach originates.
The audit paradox
Of the 245 documented incidents, 147 involved audited protocols, and together those events account for 88.44% of stolen capital. Yet only about 11% of the attacks on those protocols exploited vulnerabilities inside the audit's stated scope — roughly $396 million. The remaining value leaked through pathways an audit, by construction, never promised to cover: third-party services, infrastructure dependencies, governance procedures, frontend hosting, and operational error. The implication is structural — audits have become a quality signal for the contract layer, while the dominant attack surface now sits one or two layers above it.
Where the value actually exits
DEXs and dApps remain a steady pressure point, with around $546 million lost through smart-contract exploits across the period. The larger exposure, however, sits in the surrounding stack: more than $1.8 billion went to infrastructure and supply-chain failures, with the report citing the Bybit and KelpDAO incidents as case studies. Two more recent events reinforce the pattern — TectonicFi reportedly lost roughly $75 million in an exploit within the Cronos ecosystem, and Fogo halted its mainnet following a separate exploit. The structural lesson is consistent: the smart contract is the institution, and its dependency graph is the institution's dependency graph.
A thinner safety net, slower rule-making
Active on-chain insurance coverage has fallen from $163.2 million to $130.2 million, a 20.2% contraction, while cumulative payouts remain around $33 million. Five of nine on-chain insurance protocols are now inactive or have pivoted away from coverage by August 2026. On the regulatory side, the SEC submitted proposed amendments to its Custody Rule to OIRA on August 25, with publication expected by October 2026 and at least 60 days of public comment to follow — but a further SEC vote and effective date mean mandatory compliance could still be years away. The bottleneck has shifted from contract logic to everything around it: oracles, multisig workflows, hosting infrastructure, and governance procedures. Practically, the review checklist now reads less "is the code clean" and more "is the supply chain clean." That same dependency-graph thinking is reshaping adjacent designs as well — see how the evolution of Web3 casinos is moving toward fully on-chain architectures to reduce the very integration points where this report's largest losses occurred.