CoinGecko-2026加密资产安全现状报告- State of Crypto Security Report

coingecko

StateofCrypto

2026SecurityReport

Sponsoredby

Toobit

Content

Introduction

CryptoHacks&BreakdownbyAttackVectorTopCryptoAttackVectorsComparison

SmartContractExploits

Oracle&PriceManipulation

SupplyChain&InfrastructureExploits

SocialEngineering&PrivateKeyCompromise

2

3

4

5

6

7

8

CryptoSecurityAudits

On-ChainInsuranceProtocolsCEXInsuranceFunds

On-ChainSecurityMeasuresCEXSecurityMeasures

SummaryConclusion

9

10

11

12

13

14

coingeckoResearch

2026StateofCryptoSecurityReport

◎2026CoinGecko

Zhong

HeadofResearch

WinWin

ResearchAnalyst

2026StateofCryptoSecurityReport

◎2026CoinGecko

coingeckoResearchIntroduction

Astheoryptospacecontinuestomature,bothcentralizedanddecentralizedplatformhaveremainedontheforefrontofprovidingthehighestlevelofsecuritytosafeguarduserassetsaswellasprotectusersfromtheplethoraofattackvectorsthatexisttoday.

Unfortunately,despitethenumerousimprovementsinsecuritymeasuresandriskmitigationprotocols,theindustryhascontinuedtosufferescalatinglossesduetohacksandexploits,withover$2.5Bstolenin2025alone.

Acrosstheseincidents,theattackvectorsvarybetweencentralizedanddecentralizedinfrastructure.OntheCEXside,privatekey

exposureremainsthesinglelargestpointoffailure,whileon-chainprotocolsaremorevulnerabletosmartcontracterrorsthatcanbemanipulatedtounderminetheirintegrity.However,thesevectorsarejustthetipoftheicebergasmorerecentexploitshaveshownthathackersarequicklyadaptingtheirmethodsofgainingunauthorizedaccessbyutilzingfakeuserinterfacesformulti-sigsigningand

maliciousintegrations.

Althoughthetacticsemployedbymaliciousactorshaveconstantlyevolved,it'sworthnotingthattherelevantactorshavealso

transformeddramaticall;whileolderexploitstendtobeexecutedbysmallerteamsofrogueindividuals,organizedcryptocartelsandsyndicates,includedstate-sponsoredhackersfromNorthKorea,arenowlargelyresponsibleformostofthehacksthatoccuredinthepastyear.Combinedwithmoresophisticatedusageofmixers,bridgesandstaggeredwithdrawalstocovertheirtracks,thisnew

generationofhackershavenotoriouslybecomedifficulttotrace.

Withthatsaid,thisreportseekstoexaminethecurentlevelofstateofcryptosecurityin2026,highlightingandprovidingdeeperinsightonthedifferentkindsofhacksthattoday'splatformsconstantlyface.Aditionally,wewillalsotakeacloserlookattheeffectivenessofsmartcontractauditing,thenecessityofcryptoinsuranceprotocolsandthevarioussecurityfeaturesutilizedbyCEXessuchasToobittoprotectusersatalltimes.

coingeckoResearch

CryptoHacks&BreakdownbyAttackVector

Sincethestartof2025,cryptoplatformshavelostover$3.63B,largelyduetosupply-chainattacks,smartcontractexploitsandstolenprivatekeys.

Top20LargestCryptoExploits(2025-2026)

$1,436M

$388M

BybitBitget

$292M

$285M

KelpDaoDriftProtocol

$223M

$128M

$100M

$90M

$74M$52M$50M

$42M$42M$41M

$36M$27M$27M$26M

CetusBalancer

Bitget(VOXELExploit)Nobitex

PhemexBTCTurk InfiniCoinDCX GMXSwissborg

HumanityProtocolStepFinanceBigONE

TruebitResolvLabs

Source:DeFiLlama&supplementedbycrediblenewscoverage

*Includes245recordedcryptoexploitsthatoccurredfromJanuary

2026StateofCryptoSecurityReport

◎2026CoinGecko

CryptoExploitBreakdownbyAttackVector(2025-2026)

$311M(8.57%)

$431M(11.87%)

$3.63B

$1,806M

(49.77%)

$777M(21.41%)

■SupplyChainAttack

■SocialEngineering

■AccessControlExploit

■SmartContractExploit

■Oracle&PriceManipulation

■GovernanceAttack

■PrivateKeymReentrancy

■FlashLoan

CompromiseAttack

Attack

2025toSeptember2026

Inrecentyears,thefrequencyofcrypto-specificexploitshaveexplodedlike

neverbefore.Overthepast19months,cryptoplatformslost$3.63Bworthoffundsacross245incidents.Ofthetotalamount,morethan72.5%wasstoleninthetop10largestattackssince2025.

AcrossbothCEXesandDEXes,supplychainorinfrastructureattackshaveresultedinthemostdamagethusfar,

withover$1.8BlosttothesetypesofattackssuchastheBybitandKelpDAOhacks.

Differentplatformsaremorevulnerabletospecificexploits.ForCEXes,

compromisedprivatekeystoexchangewalletswerethemostcommonpointoffailure,whiledAppslost$546Mtosmartcontractexploits.

However,bothtypesofplatformsstillsuccumbedtomarketandoracle

manipulationcausedbyerrorsfrominternalmechanisms,suchasBinanceandHyperliquid.

coingeckoResearch

TopCryptoAttackVectorsComparison

Main

Targets

protocols,cross-chain

NumberofHacks

NotableHacks

Mechanism

Vector

(2025-2026)

CetusProtocol:$223M

Balancer:$128M

Decentralized

Theattackerfindsandexploitsabug

orlogicflawinasmartcontract'scode

todrainfundsdirectly

Theattackerdistortsapricefeedto

135

SmartContract

Exploit

bridgesandCeDeFiapplications

Bitget(VOXELexploit):$100MHyperliquid:$12M

trickaprotocolintomispricing

collateralortriggeringfalse

Oracle&Price

Manipulation

liquidations

On-chainpriceoracles,lowliquidityorderbooksandtradingpools,lendingprotocols,perpetualsandyieldvaults

dependency,orcross-chainbridge

Theattackerbreachesavendor,

BYaTBybit:$1.44B

KelpDAO:$292M

SupplyChainAttack

PrivateKeyCompromise

integrationratherthanthetarget

directly,exploitinginsufficient

9

verificationbetweensystems

RPCnodes,multi-signinginterfaces,extensions,third-partydependenciesandsoftwaredevelopmentkits(SDKs)

()Nobitex:$90MPhemex:$73.5M

Drift*:$285Mlonic:$6.94M

Theattackergainscontrolofawallet's

privatekeys,givingthemaccessto

transferorwithdrawfundsfromuser

accounts

ParticularlyCEXes,butprivatekeysof

33

DEXwalletsandimportantindividuals

canalsobetargeted

Theattackerimpersonatesatrusted

partyviafakesitesormalwareto

extractsensitiveinformationor

5

SocialEngineering

executemaliciousactssuchaslisting

Coreteammembers,protocolsigners,developersandinsiders

faketokensorsigningfraudulent

transactions.

2026StateofCryptoSecurityReport

◎2026CoinGecko

Source:CoinGecko

"DrifthasrebrandedtoVelocityaftertheexploit

coingeckoResearch

SmartContractExploits

tocircumventtheintendedlogicofaprotocol,

Codeflawsinsmartcontractsallowmaliciousactors

allowingthemtosetnewparametersortransferfundswithoutauthorization.

Whilesmartcontractsarenormallycodedtoperformspecificfunctionsasintended,theimmutabilityofthesecontractsalsomeansthathackerscanleverageonflawsinthecontract'slogic,suchasroundingandaccountingerrors,totriggerunintendedactions.

Themostcommonsmartcontractexploitsincludereentrancyandflashloanattacks,whereover$54Mhavebeenstolenthroughbothtypesofexploitssincethestartof2025.

Whileflashloansthemselvesareanintegralfeatureoflendingprotocols,itisoftenusedtodrainvaultcontracts,manipulateprices(seeSlide6)orraisefundstocommitalargerexploit.Additionally,bothreentrancyandflashloanexploitstypicallyoccurinasingletransaction,leavinglittletonotimefor

victimstointervene.

However,it'sworthnotingthatdecentralizedprotocolsarenottheonlytargetsofsmartcontractexploits;CEXesarealsoexposedthrough

misconfiguredwalletcontractsandvulnerableCeDeFiintegrations.

Source:CoinGecko

2026StateofCryptoSecurityReport

◎2026CoinGecko

ReentrancyAttack

4.Attacker

continuesto

withdrawsfunds

beforethe

balanceisupdated

3.Contractsends

users'outstanding

fundsfirstbeforethe

balanceisupdated

FlashLoanAttack

largeamountoffunds

throughaflashloan

1.Attackerborrowsa

6.Theflashloanisrepaidinthesametransaction,andthehackerpocketsthe

difference.

4.Usingtheinflatedvalue

oftheirunderlying

deposits,theattackercan

withdrawexcessfunds

fromtheprotocol

2.ThefundsareswappedintoaDEXliquiditypooltoskewtheprice

5.Theattackerusesthe

stolenfundstorepurchasetheborrowedfunds

3.Thetargetprotocol

readsthisfalsespotvalueastherealprice

coingeckoResearch

Oracle&PriceManipulation

Whiledecentralizedprotocolsaremoresusceptibleto

bemanipulatedthroughvulnerableexternalsources.

oracleattacks,pricesonCEXperpetualmarketscanalso

PriceManipulationonCEXPerpetuals

2.Atthesametime,theattackeraggressivelypurchases

tokensfromspotmarketsthattheperpetualmarketusestocalculatetheindexprice.

7.Theattackerthensellsthepurchasedspottokenstorecovertheirremainingcapital.

3.Duetothin

liquidity,spot

pricesspike

1.Attackeropensalarge

leveragedlongposition

4.Thetargetprotocol

readsthisinflatedspot

valueandrecalculatesthe

onaperpetualsmarket

withthinliquidity

indexprice

6.Attacker

closestheirlong

positionatthe

inflatedprice.

Acryptooracleisadatafeedthatsources,verifies,andtransitsexternaldatatoon-chainsmartcontractsorcentralizedplatforms.However,it'simportantto

notethattheoracleisnotthedatasourceitselfbutmerelyretrievesandverifiesthedata.Thisallows

maliciousactorstomanipulatethedatatotrickweakoraclefeeds.

Whentokenpricesmovesweakoraclesetupson

DEXesorlendingprotocolsthatrelyononlyone

oraclewillinterpretitasthecorrectdata,leadingtoinflatedcollateralvaluesormiscalculatedliquidations.

WhileCEXesdon'tgenerallyuseoracles,the

perpetualsmarketutilizesexternalspotpricesto

determineindexpriceforlessliquidtokens,which

opensadditionalvectorsforhackerstoexploit.

Besidesthat,centralizedplatformstendtofeaturemorecomplexmethodsinpricemanipulationthroughcoordinatedpump-and-dumpschemesand

automatedmarket-makingbots.

2026StateofCryptoSecurityReport

◎2026CoinGecko

Source:CoinGecko

5.Theindexandmarkpriceontheperpetualsmarketclimbs,triggeringshort

liquidationswhichpushespricesevenhigher

Anewervariantofthistypeofexploithasalso

affectedpredictionmarketssuchasPolymarket,

wheretherelevantoracleswereinfluencedthrough

_,causingthe

wagermarketstosettlewrongly.

coingeckoResearch

SupplyChain&

InfrastructureExploits

Breakdownofthe2025BybitHack

LazarusGrouphackersgain

accesstoadeveloper's

workstation/environmentfor

theSafemulti-sigwallet

Hackersstealover$1.4Bin

ETHandETHderivativesto

otherwalletsand

exchanges

injectmaliciousJavaScript

codeintotheSafemulti-sig

I0I0I0IO

Aftertwoweeksof

reconnaissance,hackers

unauthorizedaccessand

userinterface

Alltherequiredsigners

unknowinglyapprovethetransaction,allowingtheattackertogaincontrolofthemultisigwallet

Source:

2026StateofCryptoSecurityReport

◎2026CoinGecko

Insteadofadirectattack,exploitersoftenfind

alternativepointsofentrythroughvariousfirmwareand

integrationsthatcryptoplatformsrelyon.

Twodayslater,Bybit

operatorsinitiateroutineETHtransferfromcoldtowarmwallets

Signersareshown

legitimatetransaction

interface,whilehidingthe

detailsintheSafeuser-

malicioustransaction

Asupplychainattackiswhereattackerstargett

weakinfrastructureordependenciesthata

protocolrelieson,ratherthantheactualprotocolitself.Thisincludesdifferenttech-specific

componentssuchascompromisedpackages,scriptsordeveloperenvironments.

Inthecryptospace,hackershavebecomemoreprolificintargetingcrypto-specificelements

withinplatformssuchasmulti-sigwalletsandRPCnodes.

Forexample,themostrecentattackagainst

BitgetinSeptember2026resultedinover$388Minlossesashackerswereabletoexploita

vulnerabilityintheplatform'swalletinfrastructuretoexecutefraudulenttransfers.However,the

platformwasabletoutilizeitsProtectionFundto

makeuserswhole.

However,protocolsshouldalsoberesponsibleforconfiguringtheirexistingsetuptomitigaterisksagainstpotentialattacks.InboththeBybitand

KelpDAOexploits,thelackofadditional

verificationorfailsafesfortransactionvalidationwasthekeypointoffailurethatenabledhackerstodrainfunds.

engineering

coingeckoResearch

Social

SocialEngineering&

attackvectorsbutalsothemostdifficulttodefend

isoneofthemostcommoncrypto

PrivateKeyCompromise

against,oftentargetingaprotocol'scorepersonnelto

acquiresensitiveinformation

Attackersidentify

potentialtargetsand

background,

researchtheir

experience,joband

workplace

2026StateofCryptoSecurityReport

◎2026CoinGecko

Attackersdeployfakewallets,orimpersonateprotocolteam

membersto'verify'privatekeys

Attackersdeployfakebrowserextensionsorlistfakejoboffersthatcontainmalicioussoftware.

Source:CoinGecko

Victimsenterstheir

seedphraseorprivatekeys,exposingthemtothehacker

Malwareisinstalledonthe

victim'sdevice,allowingthe

hackertogainaccessto

passwordsandprivatekeys

Usingthestolen

credentials,fundsare

transferredtohacker

accountsand

laundered.

Amongallothercryptohacks,socialengineeringisstilloneofthemostcrucialentrypointsfor

hackers,oftenservingasthegatewayfor

subsequentsupplychainandaccesscontrolexploits.

Unlikeothersecuritybreaches,whichcanoftenbesolvedwithupgradesandhotfixes,bothsocial

engineeringandprivatekeycompromisestargett

thehumanaspect,whichcantakeplaceoveraverylongdurationandrequiresconstantvigilance.

Attackerscanutilizevariousmethodstogain

accesstoinsidercredentialsandprivatekeyssuch

assendingtargetedspear-phishinglinksand

malwaretohigh-rankingprotocolemployeesor

evenmasqueradingasotherknownteammembers.

Inrecenttimes,thesetacticshavebecomeeven

moresophisticated,evolvingfromsingletargettocomplexmulti-prongattackstogainavictim's

trust.Thesestrategiesaimtobolsterthehacker'slegitimacyandurgencyinobtainingaccessto

sensitiveinformation,forcingthevictimtopanic

andgiveinbeforeperformingadditionalverificationchecks.

8

coingeckoResearch

CryptoSecurityAudits

Approximately60%ofexploitedcryptoplatformshadcompletedindependent

securityaudits,butmostattacksarewellbeyondtheconventionalauditscope.

AuditedvsUnauditedProtocolExploits(Jan2025-Jul2026)*

No.OfHacks■AuditedProtocols■UnauditedProtocols

35

30

Ofthe245recordedincidentssincethestartof2025,147oftheaffectedprotocolshadbeenauditedpriortotheir

respectiveattacks,makingupover88.44%ofthetotalfundsstoleninthepast19months.

Mostoftheexploitsonauditedprotocolstargetcomponents

beyondthescopeofstandardsmartcontractaudits,newly

introducedcodethatwasnotpartoftheoriginalaudit,or

abusingfeaturesthatworkasintended(governanceattacks).

Notably,justunder11.0%oftheauditedprotocolssufferedin-scopeattacks,losing$396.0Mintheprocess.

WhileCEXesdon'tgenerallycompletethesametypesofauditsastheirdecentralizedcounterparts,theyareoftenrequiredtoundergostrictcompliancechecks,financialauditsandprovideProof-of-Reserveattestationstomaintainusersafety.

However,thisdoesnotguaranteeimmunitytootherexploitssuchassocialengineeringandprivatekeycompromise.

25

20

15

10

5

0

17

1323

5

4

6

2

7

1

2

1

16

2

4

13

14

2

2

10

1

9

3

3

3

9

8

9

7

7

7

6

5

5

5

5

6

3

Jan-25Feb-25Mar-25Apr-25May-25Jun-25Jul-25Aug-25Sep-25Oct-25Nov-25Dec-25Jan-26Feb-26Mar-26Apr-26May-26Jun-26Jul-26

2026StateofCryptoSecurityReportSource:DeFiLama,andotherveifiablesources.

◎2026CoinGecko*Someunauditedprotocolsmayhavecompletedauditsinprivate.9

coingeckoResearch

samehurdlesforclaimantsastheirtraditionalcounterparts.

On-ChainInsuranceProtocols

smartcontractfailuresandde-peggingeventsbutcarrythe

Cryptoinsuranceplatformsoffermonetaryprotectionagainst

ActiveCoverageonTop9On-ChainInsuranceProtocolsvsCumulativePayouts(Jul2025-Jul2026)*

ActiveCoverage

$250M

$200M

$150M$163.2M

ActiveCoverageAmount—CumulativePayoutsCumulativePayouts

$250M

$200M

$150M

$130.2M

Despitetheriseinexploits,activecoverageonthetopcryptoinsuranceprotocolshave

steadilydecreasedby-20.2%from$163.2Mto$130.2M,whilecumulativepayoutshavelargelyremainedstagnantat$33.0M.

Thisislikelyduetoalready-heightenedrisk

levelswiththecryptospace,whichhas

discouragedusersfromprovidingcapitalaswellaspurchasingpremiumsatelevated

prices.

$100M

$50M

$100M

$50M

Furthermore,thescopeofcrypto-based

protectioncanbeextremelyrestrictive,

limitingclaimstoonlyverifiedsmart

contractexploitsorinfrastructurefailures.

Usersmaybeunabletoreceiveapayoutiftheexploitstemsfromhumanerror,

compromisedprivatekeysorgeneralmarket

volatility.

$0M

$0M

Jul-25

Aug-25Sep-25Oct-5Nov-25Dec-25Jan-26Feb-26Mar-26Apr-26May-26Jun-26

2026StateofCryptoSecurityReport

◎2026CoinGecko

Source:

*IncludesNexusMutual,Chainproof,Sherlock,LunosDAO,UnslashedFinance,InsureDAQ,RiskHarbor,NeptuneMutual&Ease.

Assuch,thedemandforon-chaincoverhas

nevertrulyenteredthelimelight;asof

August2026,5ofthe9on-chaininsuranceprotocolshavegoneinactiveorpivotedtoothersegments.

10

◎2026CoinGecko

coingeckoResearch

CEXProtectionFunds

Platform

ToobitShieldFund

BinanceSecureAssetFundforUsers(SAFU)

MEXCGuardianFund

BitgetProtectionFund

BingXShieldFund

Mechanism

~$41.2M

·LaunchedbyToobitinOctober2025withasa$50Mdedicatedreservepoolprotectusersfromplatform-relatedlosses.

Protectionisstandardforalluserswithregardlessofaccountsizeandvolume.UserscanmonitorShieldFundassetsinreal-timeacross4dedicatedwallets.OriginallyestablishedinJuly2018toprotectuserassetsfromexploitsonBinance'sinternalmechanismsorsecurityprotocols.

BTC

~$1.25B

Aportionoftradingfeesareallocatedtothefundandstoredinasecurededicatedcoldwallet.

Thereservewillbereplenishedbackedto$1Bshouldthetotalvalueofthefundfallsbelow$800MduetoBitcoin'spricemovements.

LaunchedinJune2025toboostplatformsafetyandusertrust.

~$101.6M

USDT

TheGuardianfundscoversincidentssuchasplatformsecuritybreachesandtechnicalissues.

Allrelatedfundaddressesarepublishedpubliclyandcanbemonitoredon-chain.

BTCand$80MUSDT.

IntheaftermathofFTX'scollapse,Bitgethasincreasedtheminimumfundthresholdto$300M.

OriginallydeployedinAugust2022with$200Moffundsconsistingof6000

BTC

~$255.5M

Currentlyholds~3,067BTCasalargeportionofthefundswereusedtoreimburseusersaftertheexploitonSeptember24.

BTC

ETH

USDT

~$133.7M

LaunchedinJune2025asapermanent,fullyself-fundedreservecoveringplatform-sideincidents.

ReservewalletsarepublishedontheShieldFundpageforon-chainverificationandregularexternalaudits.

AssetsHeld

BTC

ETH①USDT⑤USDC

TotalFundValue*

·FullybackedbyWEEXandkeptstrictlysegregatedfromoperationalfunds,so

~$83.4M

BTC

eligiblelossesarecovereddirectlyratherthanthroughexternalprocesses.

WEEXProtectionFund

Walletaddressesarepublishedforon-chainverification.

2026StateofCryptoSecurityReport*Dataasof29thSeptember2026

2026StateofCryptoSecurityReport

12

◎2026CoinGecko

coingeckoResearch

On-ChainSecurityMeasures

Decentralizedprotocolutilizeamulti-layeredapproachtoensure

humanaspect-arewellprotected.

thatareallpotentialvectors-fromthesmartcontractleveltothe

SmartContractProtection

Runningmultipleindependentsaudits,

ensuringthatnewcodechangesarewithin

scope.

·Implementingextensivetimelocksonkey

smartcontractfunctions,allowingample

timeforwatcherstoraisethealarmand

respond.

·Formalverificationofsmartcontractlogictoensuretheyworkasintended.

·Constantbugbountyprogramsthataremeaningfultoincentivizeparticipationinsteadofexploitation.

·Ensurethatdependentsmartcontracttoolingisup-to-date.

Protocol-LevelProtection

·Forlendingplatforms,marketsareisolatedwithsufficientsupplyandborrowingcapstomitigaterisksofbaddebt.

·Usingmultipleweightedoraclestoderive

markandindexpriceshelpperpetualDEXestomitigatepricemanipulation.

·Implementationofwithdrawaldelaysforabnormallylargefundtransfers.

·Constantautomatedon-chainmonitoringtodetectanomalouscallsandtriggerthe

appropriatedefensemechanisms.

·Settingupaninsurancefundtomitigate

shortfallsandreimburseuserspost-attack.

AccessControl

·Fundsarestoredinmultisignaturewallets,withaccesslimitedtodedicatedhardware.

·Delegatedcontrolbetweencoreteam

members,andnoindividualpersoncandeploy

protocolupgrades.

Encryptsensitivedataandenableredundantauthenticationmeasuresforadditional

verification.

SettingupaseparateSecurityCouncilwithaccesstoimplementemergencymeasuresshouldallcorememberarecompromised.

coingeckoResearch

CEXSecurityMeasures

CEXessuchasToobitincorporatemultiplefeaturestomitigatesecurity

riskssuchasisolatedwallets,theShieldFundandreal-timemonitoring

tosafeguarduserassetsagainstvulnerabilities.

UserAccountSecurity

·Two-factorverificationwiththeoptiontoaddmoreverificationmethods.

Standardknow-your-customer(KYC)checkstotieidentitiestoaccountaccessortrace

PlatformSecurity

·VerifiedsecurityframeworkswhichareISOandSOC2-certified.

Constantauditsandpenetrationtestingon

stolenfunds.

·Anti-phishingverificationtoolsonToobithelpusersconfirmgenuinelinksand

channels.

·Withdrawalwhitelistingpreventsusersfromsendingfundstonon-approvedaddresses.

·Withdrawaldelayfornewlyadded

addresses,providingtimeforuserstobe

alerted.

2026StateofCryptoSecurityReport

bymultiplefirms.

·Multi-layeredinfrastructureandprivatekeyprotectionwithencryptionandDDoS

mitigation.

·Multi-cloudinfrastructureforresilienceandlow-latencyuptime.

·Al-poweredon-chainmonitoringwhichhappensinrealtime,allowingToobittodetectanomaloustransfers.

·ToobitShieldFund,whichholds～$38M,helpstoreimburseusersintheeventof

exploits.

Proof-of-Reserves

·ProprietaryBee-Safedefensesystemwhereover90%ofusersassetsarestoredincoldwallets.

·Userassetsarebacked1:1withreal-timeverificationavailable.

·Proof-of-Reservesreportsarepublished

regularlyandcurrentlyexceed100%forBTC,

ETH,USDC&USDT.

13

◎2026CoinGecko

2026StateofCryptoSecurityReport

◎2026CoinGecko

coingeckoResearch

SummaryConclusion

·Despitethenumeroussecurityimprovementsthathavebeenmadeinrecentyears,cryptoplatformsarestilhighlysusceptibletohacksandexploits,losingover$3.63Bacross245separateincidentssince2025.

·Thetopattackvectorsacrossbothcentralizedanddecentralizedprotocolsincludesmartcontractexploits,oracle&pricemanipulation,aswellasprivatekeycompromises,withacumulativetotalof190recordedattackssince2025.

·Smartcontractexploitsenablehackerstotakeadvantageofcodeflawsintoopportunitiestofreezeorsteelfunds.Commonmethodsincludereentrancyattacksthatrepeatedlydralnsfundsbeforeacontract'sstateisupdatedorutllzinglegitimatetoolssuchasflashloanstodralnsignificantvaultbalancesinasingletransaction.

·AIthoughcryptooraclesarecrucialforbringingexternaldataon-chain,thedataitselfcanbefalsifiedtomanipulatelending,perpetualandpredictionmarketsintheattacker'sfavor.

·Supply-chainattackstargetaplatform'sinfrastruotureinsteadoftheplatformitself,relyingonvulnerabledependenciesandsoftwareasentrypoints,whichcanaffectmultipleplatformsthatutilizethesameservices.

·Thehumanelementincryptoisoftenthemostunder-lookedattackvectorbutalsothemostdangerous,asmaliciousactorsarehavebeguntousemorevariedandsophisticatedsocialengineeringtechniquestoconvincevictimstocompromisetheirsensitivedataandprivatekeys.

·Smartcontractauditsareakeypartofmaintainingprotocolsecuritybeforedeployment,buttheyarenotcompletelyfoo-proofasnarrowscopesandundocumentedcodechangescould