Crypto platforms lost $3.63 billion across 245 documented incidents between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report published August 27, 2026. During the same period, on-chain insurance protocols paid out approximately $33 million — covering less ...
Crypto platforms lost $3.63 billion across 245 documented incidents between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report published August 27, 2026. During the same period, on-chain insurance protocols paid out approximately $33 million — covering less than 1% of aggregate losses.
Active coverage on the nine insurance protocols tracked by CoinGecko fell 20.2%, from $163.2 million to $130.2 million. Five of those nine protocols have shut down or pivoted away from crypto coverage entirely by August 2026. The remaining four — led by Nexus Mutual — now backstop a pool of capital that represents roughly 0.18% of DeFi's approximately $70 billion in total value locked.
The contraction arrives as attack frequency climbs. PeckShield counted 50 major crypto hacks in August 2026, up 67% from 30 in July, the highest monthly incident count of the year. The numbers expose a structural mismatch: the industry's risk surface is expanding while its coverage base is shrinking.
CoinGecko's report catalogs 245 security incidents from January 2025 through July 2026. The distribution is concentrated: the top 10 attacks accounted for 72.5% of total stolen value.
By attack vector:
| Category | Losses | Share | |---|---|---| | Infrastructure & supply chain | $1.81B | 49.9% | | Smart contract exploits | $777M | 21.4% | | Oracle/price manipulation | $546M | 15.0% | | Other (governance, phishing, etc.) | $496M | 13.7% |
Infrastructure and supply-chain attacks — where adversaries compromise signing keys, deployment pipelines, or third-party software dependencies — proved the most costly vector. The February 2025 Bybit hack exemplifies the category: North Korea-linked attackers exploited a vulnerability in free storage software used to move Ethereum, draining $1.5 billion in a single incident. Bybit covered $1.4 billion from its own balance sheet without triggering an insurance payout.
The August 2026 Cronos-Tectonic exploit followed a different pattern. An attacker used $600,000 to inflate the TONIC token price by 40x, then borrowed against the manipulated collateral. Total damage: approximately $74 million. Cronos validators halted block production, trapping $60 million on-chain while roughly $6 million was bridged to Ethereum. The chain subsequently rolled back to a pre-attack state — an intervention that limited losses but raised questions about immutability guarantees.
August 2026 alone saw $136.3 million in total losses across 50 incidents, per PeckShield. The Tectonic exploit accounted for more than half.
CoinGecko tracked nine on-chain insurance protocols. As of August 2026, five have either shut down or abandoned crypto coverage. The surviving protocols:
| Protocol | Estimated TVL | Focus | |---|---|---| | Nexus Mutual | ~$102M–$198M | Smart contract, custodian, yield token cover | | InsurAce | ~$150M | Multi-chain protocol coverage | | Unslashed | ~$3.5M | Staking and validator risk | | Other active | Minimal | Various niche products |
Nexus Mutual, the largest by TVL, has paid approximately $18–25 million in claims since inception in 2019 and reports roughly 10,000 members. The protocol offers 100+ cover products. InsurAce has grown premiums approximately 35% year over year, driven primarily by stablecoin depeg demand.
Total active on-chain coverage stands at $130.2 million, down from $163.2 million. For context, DeFi TVL sits at approximately $70–72 billion as of mid-2026, according to DefiLlama. On-chain insurance covers roughly 0.18% of DeFi deposits — a coverage ratio that would be considered catastrophically inadequate in any traditional financial market.
Cumulative payouts across all tracked protocols total $33 million against $3.63 billion in losses. The implied coverage rate: 0.9%.
The CoinGecko report found that 147 of 245 exploited platforms — 60% — had completed independent security audits before they were breached. Those audited platforms accounted for 88.44% of total capital drained.
The disconnect has a specific explanation: only 11% of successful attacks exploited vulnerabilities within the scope of a standard smart contract audit. The remaining 89% of attack vectors — infrastructure compromise, private key theft, oracle manipulation, governance exploits, supply-chain attacks — fall outside the conventional audit perimeter.
This matters for the insurance market because most on-chain coverage products are structured around smart contract failure. If the majority of losses come from vectors outside both audit and insurance scope, the product architecture mismatches the risk profile.
Breakdown of attack surface versus coverage scope:
On-chain insurance products carry significant exclusions. Standard policies typically do not cover:
According to CoinGecko, smart contract failures account for approximately 65% of insurance-related claims that are actually paid. Stablecoin depeg events represent roughly 22% of paid claims.
The narrowness of coverage creates an adverse selection dynamic. Sophisticated DeFi operators who understand the exclusions often conclude that the premium-to-coverage ratio does not justify the cost. Retail users, who might benefit most from protection, often do not understand the product limitations until a claim is denied.
Coverage prices fell below 1% annually for select low-risk projects on Nexus Mutual in early 2025, but premiums for higher-risk protocols remain elevated — deterring both underwriters from providing capital and buyers from purchasing coverage.
Centralized exchanges have largely bypassed the on-chain insurance market by building internal protection reserves funded by trading fee allocations.
| Exchange | Protection Model | Estimated Size | |---|---|---| | Binance (SAFU) | 10% trading fee allocation | $1.16B | | Bitget (Protection Fund) | Dedicated reserve | $300M+ | | Coinbase | Commercial crime insurance policy | Covers hot wallet holdings | | Kraken | Full-reserve model | 100% deposit backing |
Binance's SAFU fund, established in 2018, paid $7 million in December 2025 to cover Trust Wallet vulnerability losses. Coinbase maintains what analysts describe as the largest commercial crime policy covering hot wallets in the crypto industry, safeguarding approximately $193 billion in total digital holdings.
These self-insurance models represent a fundamentally different approach from the mutual-pool model used by on-chain protocols. Exchange reserves are funded by revenue, not capital provider deposits, and their coverage scope is determined by internal policy rather than smart contract parameters.
The Bybit hack illustrated both the strength and limitation of this model. The exchange absorbed $1.4 billion in losses from its balance sheet — a capability that no on-chain insurance protocol could match. However, the approach requires exchanges to maintain reserves proportional to their risk exposure, a burden that only the largest platforms can sustain.
RE Protocol, which launched its token on June 18, 2026, represents an attempt to bridge the traditional reinsurance market with on-chain infrastructure. The protocol reported $191.6 million in premiums written in 2025 with a 92% combined ratio — a figure that, if accurate, would indicate underwriting profitability.
The protocol's reUSD vault holds approximately $149 million in active TVL. RE Protocol targets $300–500 million in premiums for 2026 as it onboards traditional reinsurers via oracle-mediated data feeds.
The model differs from Nexus Mutual's peer-to-peer coverage approach: RE Protocol positions itself as an intermediary layer connecting institutional reinsurance capital with on-chain risk. Whether institutional reinsurers will underwrite crypto-native risks at scale — given the loss history documented above — remains an open question. The 92% combined ratio suggests profitable operations in 2025, but the sample period did not include a Bybit-scale event.
The fundamental challenge for crypto insurance is actuarial. Traditional insurance relies on large, diversified risk pools with predictable loss distributions. Crypto risk has the opposite characteristics:
To price coverage accurately, insurers would need premiums that reflect a loss rate of approximately 5% annually against DeFi TVL (based on $3.63B in losses over 19 months against an average TVL of roughly $90B). At that rate, premiums would consume a significant share of DeFi yields — which have themselves compressed, contributing to the TVL decline from $115 billion in January 2026 to $70 billion by mid-year.
The result is a market that cannot price risk at a level that both attracts underwriting capital and remains affordable for buyers. Five of nine protocols exiting the market is the predictable outcome of this structural mismatch.
$3.63B lost, $33M insured. On-chain insurance covered 0.9% of crypto platform losses between January 2025 and July 2026. Five of nine tracked insurance protocols have exited the market.
Coverage is shrinking as attacks accelerate. Active on-chain coverage fell 20.2% to $130.2M while August 2026 recorded 50 hacks — the highest monthly count of the year.
Audits do not equal security. 60% of exploited platforms had completed audits; those audited platforms accounted for 88.44% of total capital lost. Only 11% of attacks exploited audit-scope vulnerabilities.
CEX self-insurance dominates. Binance's $1.16B SAFU fund, Bitget's $300M+ reserve, and Coinbase's commercial policies collectively dwarf the entire on-chain insurance market.
Product-risk mismatch persists. Most on-chain policies cover smart contract failure. Most losses come from infrastructure compromise, supply-chain attacks, and oracle manipulation — categories that fall outside standard coverage.
RE Protocol offers a structural alternative. With $191.6M in 2025 premiums written and a 92% combined ratio, RE Protocol's reinsurance model bridges traditional and on-chain capital. Scalability is unproven.
The crypto insurance market is contracting precisely when it should be expanding. The $130.2 million in active on-chain coverage is a rounding error against $3.63 billion in documented losses and $70 billion in DeFi deposits. The market's failure is not operational but structural: crypto risk is too concentrated, too unpredictable, and too poorly matched to existing product architectures for mutual-pool insurance to scale.
The industry has responded with workarounds. Exchanges build internal reserves. Chains halt and roll back after exploits. Protocols pursue audits that cover 11% of the actual attack surface. RE Protocol attempts to import institutional reinsurance capital. None of these approaches solves the underlying problem: crypto's security infrastructure produces losses at a rate that exceeds the capital available to insure them.
Until the loss rate declines, the coverage ratio decreases, or fundamentally new risk-transfer mechanisms emerge, the insurance gap will remain the industry's largest unaddressed systemic vulnerability.