Crypto hacks have cost the industry $3.63 billion across 19 months of exploit activity, with infrastructure attacks and private key compromises accounting for the largest share of losses, according to a new report from crypto data aggregator CoinGecko.
Key Takeaways
Crypto hacks cost $3.63 billion across 19 months of recorded exploit activity
Infrastructure attacks and private key compromises accounted for the largest losses
Bridge exploits remained a recurring attack vector throughout the period
The report highlights the ongoing security challenges facing the crypto industry
$3.63B Lost to Crypto Hacks in 19 Months
CoinGecko's report aggregates data on crypto hacks and exploits over a 19-month period, finding that the industry lost approximately $3.63 billion to malicious activity. The figure encompasses a range of attack types, including smart contract exploits, bridge hacks, private key compromises, and social engineering attacks. Infrastructure attacks, which target the underlying systems and services that support crypto operations, accounted for the largest share of losses, followed by private key compromises that gave attackers direct access to project wallets and user funds.
The report's findings underscore the persistent security challenges facing the crypto industry despite advances in auditing, monitoring, and incident response. The $3.63 billion figure represents only documented losses and may understate the true cost of crypto crime, as some incidents go unreported or are resolved without public disclosure. This comprehensive data connects to individual security incidents we've covered, including the CCC exploit on BSC, the Moonwell MAMO exploit draining $8.7M, and the Term Finance Meta Vaults attack.
Bridge Exploits Remain Major Attack Vector
Cross-chain bridge exploits continued to be a significant source of losses throughout the 19-month period. Bridge protocols, which lock assets on one blockchain and mint representative tokens on another, have been among the most frequently exploited components in DeFi. The Sandbox's recent announcement that it would reimburse SAND holders after a 14.7 million token bridge exploit highlights the ongoing vulnerability of cross-chain infrastructure. Other notable bridge exploits during the period contributed significantly to the overall $3.63 billion figure.
The persistence of bridge exploits has driven some projects to explore bridgeless alternatives. Postquant Labs recently launched quantum cross-chain swaps using a bridgeless protocol, and Ripple recommended withdrawing the XRPL XChainBridge amendment. These developments suggest the industry is gradually moving away from traditional bridge infrastructure toward more secure cross-chain solutions.
Infrastructure Attacks Dominate Loss Categories
Infrastructure attacks, which compromise the servers, APIs, and custody systems that support crypto operations, accounted for the largest losses in the CoinGecko report. These attacks often target centralized components within otherwise decentralized ecosystems, exploiting weaknesses in key management, access controls, and operational security. Private key compromises, which can result from phishing attacks, insider threats, or inadequate key management practices, represented another major loss category.
The concentration of losses in infrastructure and key management vulnerabilities highlights the importance of operational security practices alongside smart contract auditing. While much of the industry's security focus has been on code vulnerabilities, the CoinGecko data suggests that human and operational factors remain significant sources of risk. This finding has implications for how crypto companies allocate their security resources, potentially shifting more attention toward infrastructure hardening and key management practices.
Looking Ahead: Security Evolution
The $3.63 billion figure represents a significant challenge for an industry seeking mainstream adoption and institutional trust. As regulatory frameworks mature and institutional participation grows, the pressure to reduce hack-related losses will intensify. The CoinGecko report's findings may influence how regulators, insurers, and institutional investors assess crypto risk, potentially driving higher standards for security practices across the industry.
