A new report has found that while attacks on cryptocurrency projects usually cause substantial financial losses at first, the real damage often emerges over the course of several months, impacting a project’s ecosystem long after the initial incident. Immunefi, a leading cybersecurity platform, highlights these far-reaching effects in its latest report, “State of Onchain Security 2026,” underscoring the ongoing challenges facing the crypto sector in the wake of repeated security breaches.
Crypto Attacks Continue to Shake the Ecosystem
Immunefi is recognized as a major player in identifying security flaws and running bounty programs for decentralized finance (DeFi) networks and crypto projects. According to its new report, there were 191 attacks recorded between 2024 and 2025 across the crypto industry, resulting in total losses of $4.67 billion. The accumulated toll over the past five years now stands at $11.9 billion, painting a stark picture of persistent vulnerabilities.
Despite the scale of these losses, the annual number of attacks showed little movement, with 94 incidents in 2024 and 97 in 2025. This stagnation signals that the industry has not managed to make significant strides in security. High-profile attacks tend to dominate discussion for months, effectively shaping the risk landscape throughout the year.
The report also spotlighted an uneven distribution in the size of the attacks. While the median attack value declined to $2.2 million, the average loss per incident stood at a much higher $24.5 million for the 2024–2025 period. Notably, just the five largest attacks were responsible for a staggering 62% of all losses, with a colossal $1.5 billion breach at the Bybit crypto exchange in 2025 accounting for nearly half of that year’s total loss.
Aftermath and Lingering Effects of Attacks
The Immunefi report details how the fallout from attacks on crypto projects continues to deepen well beyond the first few days. It reveals that while the tokens of affected projects typically lose 10% of their value within two days, this slump worsens significantly—with losses climbing to 61% on average after six months. Only about 16% of projects ever recover above their pre-attack token price half a year later.
A project’s token price is not just a concern for holders; it carries major financial consequences for the core team. Crypto startups often rely on their native tokens as treasury assets and funding vehicles. Prolonged drops in token value can undermine hiring, weaken their market position, and sap morale across the organization.
The report further found that most affected projects lose key members of their security teams in the immediate aftermath and require at least three months to initiate a recovery. Such high-profile crises inflict a chain reaction of problems—eroding reputation, prompting capital flight, and diminishing opportunities for partnership within the industry.
Interconnectedness in DeFi has intensified these risks. As protocols become more integrated, a security breach on one platform can rapidly spill over to others. This is particularly acute in areas such as cross-chain bridges, stablecoins, and liquid staking, where vulnerabilities tend to compound and spread.
The report’s findings also emphasize that centralized exchanges remain exposed at the heart of these risks. Out of the 191 incidents over the last two years, only 20 targeted major exchanges, but these accounted for 54.6% of the total assets stolen. Immunefi concluded that security threats extend beyond flaws in smart contracts, suggesting the concentration of trust in centralized structures remains a crucial weak link.
