A total of 245 security incidents were recorded from January 2025 to July 2026, with the top 10 attacks accounting for more than 72.5% of stolen funds. According to ChainCatcher, supply chain and infrastructure vulnerabilities remained the main security risks for centralized and decentralized exchanges, causing losses of more than $1.8 billion.

Private key leaks were the most common risk for centralized exchanges, while DApps lost about $546 million to smart contract vulnerabilities. According to ChainCatcher, among 147 incidents involving platforms that had completed independent security audits, stolen funds accounted for 88.44% of total losses.

Most attacks fell outside the scope of traditional audits, with common causes including external infrastructure, unaudited code updates, and governance attacks. Only about 11% of incidents involved smart contract flaws within audit coverage.