Crypto platforms have lost over $3.63 billion to cyberattacks — even though most of them did security checks

Between January 2025 and July 2026, cryptocurrency platforms have lost more than $3.63 billion due to a variety of cyberattacks and stolen passkeys, the report said.

Around 88% of the stolen funds and about 60% of the affected platforms had “completed independent security audits,” the report said. It noted most of the attacks targeted areas that checks do not typically cover.

Bybit was most affected, the report said, citing the $1.4 billion February 2025 heist that Elliptic attributed to North Korea. Second-most affected was KelpDao, with $292 million lost, followed by Drift Protocol, with $285 million lost, the report said.

Bybit, KelpDao and Drift Protocol didn’t immediately respond to a CNBC request for comment.