The cryptocurrency industry's security infrastructure is undergoing its most significant transformation since the invention of the hardware wallet. After suffering $17 billion in combined hack, scam, and fraud losses in 2025 — crowned by the $1.5 billion Bybit heist that exposed fatal weaknesses ...
"Even if we are experiencing a bank run, it's not an issue. We have enough tokens to give to the clients." — Ben Zhou, CEO of Bybit, during the $1.5 billion hack crisis in February 2025
The cryptocurrency industry's security infrastructure is undergoing its most significant transformation since the invention of the hardware wallet. After suffering $17 billion in combined hack, scam, and fraud losses in 2025 — crowned by the $1.5 billion Bybit heist that exposed fatal weaknesses in multi-signature wallet architecture — the industry has responded with an unprecedented security buildout. February 2026 hack losses plunged 98.2% year-over-year to just $26.5 million, the lowest monthly figure since March 2025.
This is not a statistical anomaly. It is the measurable result of a structural shift in how digital assets are secured. The crypto security market has expanded to $6.79 billion in 2026 — a 25.7% year-over-year increase — driven by institutional mandates, regulatory pressure from MiCA and the forthcoming GENIUS Act, and a wholesale migration from traditional multi-signature wallets to Multi-Party Computation (MPC) technology. The question is no longer whether the industry can protect itself, but whether the security infrastructure buildout can keep pace with the $60 billion in institutional assets now flowing into the ecosystem.
The numbers from 2025 are staggering. According to Chainalysis, the cryptocurrency industry lost $3.4 billion to direct hacking alone, with three massive breaches accounting for 70% of total losses. When scams, phishing, and social engineering are included, the total climbs to approximately $17 billion — making 2025 the worst year on record for crypto security.
The single event that reshaped the industry's security posture was the Bybit hack on February 21, 2025. North Korean state-sponsored hackers from the Lazarus Group — specifically the FBI-designated TraderTraitor subunit — executed a supply chain attack against Safe{Wallet} (formerly Gnosis Safe), the most widely used multi-signature wallet infrastructure in crypto. The attackers did not exploit a smart contract vulnerability. Instead, they compromised a Safe developer's machine, gained access to AWS credentials and S3 storage, and injected malicious JavaScript that specifically targeted Bybit's contract address. The code altered transaction content during the signing process, allowing the attackers to drain over 401,000 ETH worth $1.5 billion while signers believed they were approving routine transfers.
The attack's sophistication revealed a fundamental flaw in the multisig security model: the assumption that multiple human signers examining a transaction provides sufficient security. When the signing interface itself is compromised, every signer sees the same spoofed transaction. The multisig becomes theater.
Within 48 hours, at least $160 million of the stolen funds had been laundered. Yet Bybit survived. CEO Ben Zhou kept withdrawals open, sourced replacement ETH from partner exchanges, and fully replenished reserves within days — a crisis management performance that became a case study in operational resilience. But the broader lesson was clear: the industry's most trusted security infrastructure had been weaponized against it.
The aftermath extended beyond Bybit. In January 2026 alone, crypto hack losses hit $86 million, including the Step Finance treasury breach ($30 million) and a devastating social engineering scam that cost a single investor $284 million after phishing attackers impersonated Trezor customer support. That incident alone underscored the Chainalysis finding that 2025's losses were overwhelmingly "a people problem, not a code problem."
The Bybit hack catalyzed the most significant infrastructure migration in crypto's history: the wholesale shift from traditional multi-signature wallets to Multi-Party Computation (MPC) technology.
Traditional multisig wallets require multiple private keys to authorize transactions. Each key exists as a complete, recoverable unit. If a signer's device is compromised — or if the UI they use to review transactions is spoofed — the security model collapses. This is exactly what happened with Bybit.
MPC wallets take a fundamentally different approach. Instead of storing complete private keys on individual devices, MPC splits the key into encrypted shards distributed across independent systems. No single shard can reconstruct the key. Transaction signing occurs through a cryptographic protocol where each party computes their share of the signature without ever revealing their shard to other participants. The complete private key never exists in any single location at any point in the process.
This architectural difference renders the Lazarus Group's attack vector — UI spoofing to deceive human signers — largely ineffective. There is no single interface to compromise, no single key to steal, and no single point of failure to exploit.
The migration has been swift. According to industry data, most top-tier centralized exchanges have now migrated from traditional smart-contract multisigs to MPC technology. The crypto wallet market surged 32% in 2025 to reach $19 billion, driven in large part by institutional demand for MPC-based self-custody solutions. By 2026, the question at institutional custody providers like Fireblocks, Cobo, and Safeheron has shifted from "What is MPC?" to "How do we implement MPC correctly?"
The implementation details matter enormously. MPC technology alone does not guarantee security. The critical variables are: who controls the key shards, where the signing infrastructure is hosted, and how policy enforcement is applied. A SaaS MPC provider that controls key shards on behalf of clients introduces its own custodial risk — a subtlety that separates genuine security upgrades from repackaged centralization.
No major MPC breach has occurred since the technology entered production use, a track record that stands in stark contrast to the multi-billion dollar failure record of traditional multisig and hot wallet architectures.
The crypto security market is experiencing a capital inflow cycle unlike anything in the sector's history. According to Research and Markets, the global crypto security market expanded from $5.42 billion in 2025 to $6.79 billion in 2026 — a 25.7% CAGR — and is projected to reach $26.92 billion by 2032. Future Market Insights projects the sector could reach $28.5 billion by 2036.
This growth is not speculative. It is being driven by three converging forces:
Regulatory mandates. The EU's Markets in Crypto-Assets Regulation (MiCA), fully applicable since December 2024, mandates specific custody, governance, and cybersecurity requirements for crypto-asset service providers. In the U.S., the GENIUS Act's implementing regulations — expected by January 2027 — will impose similar requirements on stablecoin issuers and custodians. The CFTC and SEC's joint "Project Crypto" initiative, announced in January 2026, signals coordinated federal oversight that will require institutional-grade security infrastructure.
Institutional entry. The entry of traditional financial institutions — BlackRock, Fidelity, ICE — into crypto markets is imposing enterprise security standards on an industry that historically operated with startup-grade infrastructure. Multi-signature wallets and custodial tools are now used by 61% of institutions to secure digital assets, and $14.5 billion has been invested globally in digital asset cybersecurity infrastructure.
Insurance economics. Nexus Mutual, the leading DeFi insurance protocol, has protected over $6 billion in digital assets and paid over $18 million in claims since 2019. But the gap between total losses and insured losses remains enormous — the $17 billion lost in 2025 versus the sector's limited claims capacity highlights a market failure that is driving demand for prevention over coverage. The economics are simple: security infrastructure that prevents hacks is vastly cheaper than insurance that pays out after them.
Notable M&A activity reflects the buildout. In Q3 2025, Fireblocks acquired BlockSec, a blockchain security startup, to bolster its custody technology stack. The crypto custody provider market alone grew from $3.28 billion in 2025 to $3.69 billion in 2026, with projections to reach $7.74 billion by 2032 at a 13.05% CAGR.
The smart contract audit market has evolved from a cottage industry of boutique firms into a structured, institutionalized sector. Audit costs in 2026 range from $5,000 for simple token contracts to $500,000+ for complex DeFi protocols, with average DeFi protocol audits (DEXs, lending protocols) falling between $50,000 and $100,000. Formal verification — mathematical proof that code invariants cannot be broken — adds $20,000 to $50,000 to the base price.
The data makes the economic case for auditing overwhelmingly clear: only 20% of hacked protocols had been audited, while audited protocols experience 98% fewer security incidents. Audited projects also raise 37% more capital, creating a direct financial incentive that goes beyond risk mitigation.
In 2026, most serious teams treat auditing as an ongoing operational expense rather than a one-time checkbox. The LlamaLend/sDOLA exploit on March 2 — where an attacker used $30 million in flash loans to manipulate oracle pricing and liquidate 27 users for a $240,000 profit — illustrated that the attack surface has shifted from core smart contract logic to peripheral infrastructure: oracle configurations, pool parameters, and collateral mechanics. The root cause was an improper oracle configuration by the pool creator, not a flaw in the underlying protocol code.
This shift demands a new security paradigm. Traditional audits verify code correctness. But the emerging attack vectors target the assumptions between protocols — the oracle feeds, the liquidity pool parameters, the bridge configurations. The most sophisticated attackers are not finding bugs in code; they are finding gaps in the economic assumptions that connect protocols to each other.
The February 2026 data tells a striking story. PeckShield reported total crypto hack losses of $26.52 million across 15 incidents — a 98.2% year-over-year decrease from February 2025 and a 69.2% decline from January 2026. The first two months of 2026 combined saw $112.53 million in losses, a fraction of the comparable 2025 period.
While it is premature to declare victory, the trend suggests that the post-Bybit security buildout is delivering measurable results. The combination of MPC migration, regulatory pressure, institutional security standards, and improved audit practices is creating a structurally more resilient ecosystem.
The FATF's response to the Bybit hack reinforced this trajectory, urging jurisdictions to accelerate licensing, supervision, and international coordination. The organization framed the incident as evidence that weaknesses in custody and transaction oversight pose systemic risks to the global financial system — language that effectively recategorizes crypto security from a niche technical concern to a financial stability issue.
The remaining challenge is the long tail: smaller protocols, bridge operators, and DeFi composability layers where security investment lags behind the blue-chip exchanges and custodians. The LlamaLend exploit demonstrated that even when core infrastructure is secure, misconfigured peripheral components create exploitable gaps. The next frontier of crypto security is not protecting individual protocols but securing the connections between them.
The crypto security landscape of early 2026 represents a structural break from the industry's historically cavalier approach to asset protection. The $17 billion in losses during 2025 — culminating in a $1.5 billion heist that weaponized the industry's most trusted wallet infrastructure — forced a reckoning that no amount of market commentary could have achieved.
The response has been proportional to the crisis. A $6.79 billion security market, an industry-wide migration to MPC custody, and regulatory frameworks that treat crypto security as a financial stability concern are collectively raising the floor on what constitutes acceptable infrastructure. The 98.2% drop in February hack losses is the first evidence that these investments are translating into outcomes.
But the economic-value lens demands caution. Security infrastructure is a cost layer — part of the $86-113 billion in annual ecosystem funding that sustains blockchain operations. If the security market reaches its projected $27 billion by 2032, it will represent a significant new cost burden that users and protocols must absorb. The question is whether this investment generates sufficient value — in institutional trust, regulatory compliance, and reduced losses — to justify the expense.
The early evidence suggests it does. But the industry's track record warrants skepticism over celebration. The attackers are also adapting, shifting from smart contract exploits to supply chain attacks, oracle manipulation, and AI-enhanced social engineering. The $7 billion security buildout is a necessary condition for crypto's institutional future. It is not yet a sufficient one.