The cryptocurrency sector continues to face severe security challenges, having suffered losses exceeding $3.63 billion due to sophisticated cyberattacks and compromised passkeys between January 2025 and July 2026. This ongoing vulnerability highlights the evolving tactics of malicious actors in the digital asset space, targeting infrastructure vulnerabilities that standard defensive measures often fail to address.

Alarmingly, the vast majority of compromised platforms had previously taken proactive steps to secure their networks. Data indicates that approximately 88 percent of the stolen funds and roughly 60 percent of the affected protocols had successfully completed independent security audits prior to the incidents. Industry specialists note that many of these breaches exploit complex architectural weaknesses and edge cases that traditional pre-launch code reviews typically do not cover.

Among the most severely impacted entities, Bybit experienced the largest single loss, driven by a massive $1.4 billion heist in February 2025. Other notable protocols also suffered substantial setbacks during this timeframe, including KelpDao with $292 million in lost assets and Drift Protocol facing $285 million in damages. These events underscore the urgent need for continuous runtime monitoring and more comprehensive vulnerability assessments across the decentralized finance ecosystem.

Key Takeaways

• Cryptocurrency platforms lost over $3.63 billion to cyberattacks and stolen passkeys between January 2025 and July 2026.
• Around 88% of the stolen funds and 60% of affected platforms had previously completed independent security audits.
• Bybit, KelpDao, and Drift Protocol accounted for some of the largest losses during this period.

Editor’s Analysis & Impact

The staggering volume of capital lost to cyberattacks—despite the implementation of standard security audits—reveals a critical vulnerability in the current Web3 security paradigm. Traditional code reviews, while essential, often act as static snapshots of a protocol at a specific point in time, failing to capture dynamic threat vectors, complex economic exploits, or runtime logic failures. As decentralized finance (DeFi) protocols grow in scale and complexity, the industry must transition from periodic compliance-based auditing to continuous, real-time threat intelligence and automated runtime monitoring. For the broader market, these persistent security failures threaten institutional adoption and retail confidence. Moving forward, platforms that invest in advanced defensive architecture, decentralized insurance funds, and proactive bug bounty programs will likely gain a competitive edge in retaining user trust.

Frequently Asked Questions

Q: How much money was lost by crypto platforms between January 2025 and July 2026?
A: Cryptocurrency platforms lost more than $3.63 billion to various cyberattacks and stolen passkeys during this period.

Q: Did the hacked platforms undergo security checks?
A: Yes, approximately 88% of the stolen funds and 60% of the affected platforms had completed independent security audits before being attacked.

Q: Which crypto platform suffered the largest loss?
A: Bybit suffered the largest single loss, highlighted by a $1.4 billion heist in February 2025.