NextFin News - Crypto has spent years selling speed, openness and lower intermediation costs. Lorenzo Valente, director of digital-asset research at ARK Invest, argues that the industry has also accumulated a less visible bill: $26.9 billion in losses from hacks since 2017. The figure is an estimate attributed to Valente rather than a single official loss ledger, but its implication is testable. Security failures are not just isolated criminal events; they can become a recurring operating cost that is passed through to users, developers and investors.
That creates the central tension as digital assets move toward broader institutional use. Institutional adoption is moving toward regulated custodians, stablecoins and tokenized markets, while the technology stack still contains bridges, multisignature systems, smart contracts and human approval processes that can fail in different ways. The question is not whether crypto can eliminate theft. No financial system has done that. The question is whether the loss rate is falling fast enough, and in the right parts of the system, to support the next stage of adoption.
Valente’s comparison makes the issue more concrete. He has put average annual crypto hacking losses since 2018 at 0.24% of total crypto market capitalization, versus 0.017% of U.S. bank deposits lost to fraud. That is roughly 14 times higher, but the denominators differ: market value is not the same as deposits, and hacking losses are not identical to all bank fraud. The comparison is therefore a warning about economic burden, not a like-for-like default rate.
Independent security data point in both directions. Immunefi’s six-year DeFi analysis says protocol losses fell roughly 80%, from a 2022 peak of $2.62 billion to $534 million in 2024. Its median loss per incident fell from $6 million in 2022 to $1.5 million in 2025. Bridge-related losses also declined from 73% of DeFi losses in 2022 to 3% in 2025. Those are material improvements. They do not prove that the security problem has been solved, because the attack surface has migrated toward custody, private keys, suppliers and social engineering.
The result is a split diagnosis. The annual intensity of some exploit categories is cyclical and has improved as protocols mature. The underlying security burden is structural because crypto keeps adding value-bearing software and intermediaries faster than it removes concentrated points of failure.
The $26.9 Billion Estimate Is a Cost Signal, Not a Balance Sheet
The first analytical mistake would be to treat $26.9 billion as a universally agreed accounting total. The figure comes from Valente’s analysis, and the exact boundaries of the estimate are not established by a public, single-source ledger in the material available for this article. It may include direct theft from protocols and custodians across several years, while other databases separate exploits, scams, exchange compromises and funds later recovered. Those classification choices can change the total.
That uncertainty does not make the number irrelevant. It changes what the number is useful for. The figure is best understood as a cost signal: an attempt to measure how much value the industry has placed at risk through code, custody and coordination failures. It points investors toward the expense that revenue multiples and token prices often omit—the expected loss embedded in the infrastructure.
Valente’s 0.24% comparison supplies the mechanism. If a protocol loses funds, it can absorb the loss from a reserve, raise fees, dilute holders, impose withdrawal restrictions or rely on outside capital. If an exchange is compromised, it can reimburse users, use an insurance fund or socialize the cost. If a bridge fails, liquidity providers and counterparties can be left with assets that no longer match their claims. Each response redistributes the loss rather than making it disappear.
That redistribution resembles a tax, but it is not collected uniformly. Large, regulated custodians may have balance sheets, insurance and incident-response teams. Smaller protocols may have none of them. A user choosing between two similar applications may therefore pay through a higher fee, a lower yield, wider slippage or a greater probability of unrecovered loss. Security is part of the product price even when it is not shown as a line item.
The distinction also matters for market valuation. A theft that removes $100 million from an application is not economically equivalent to $100 million spent on development. Development may create future cash flow; the stolen amount creates a hole that someone must fill. Yet both can be treated as ecosystem activity in broad revenue or total-value statistics. Loss data is therefore a corrective to growth metrics that count capital entering the system but not the friction required to keep it there.
The headline estimate should not be used to claim that traditional finance is risk-free. Banks suffer fraud, cyberattacks and operational losses, and customers ultimately bear some of those costs. The relevant question is comparative resilience: how much loss occurs relative to the value secured, how quickly institutions contain it, and whether users can identify who is responsible before they commit capital.
Crypto still has an accountability problem. Code can be autonomous, but the system around the code is not. Validators, signers, front-end providers, oracle operators, bridge committees, exchange employees and cloud suppliers all introduce human or institutional failure points.
Security Has Improved Where the Industry Can Standardize
The strongest evidence against a simple “crypto is getting less safe” narrative comes from the decline in several DeFi loss measures. Immunefi’s reported fall from $2.62 billion in 2022 to $534 million in 2024 is too large to dismiss as noise. The decline in median incident loss from $6 million in 2022 to $1.5 million in 2025 is also important because a lower median suggests that ordinary failures are becoming less destructive even when occasional mega-incidents dominate the headlines.
Bridge security offers an even clearer example of learning. Bridge-related incidents accounted for 73% of DeFi losses in 2022, according to Immunefi’s analysis, but 3% in 2025. The change reflects more than luck. Developers have reduced reliance on some fragile designs, users and liquidity providers have become more selective, and large protocols have increased scrutiny of code and validator structures.
Ethereum’s developer documentation describes the remaining trade-off directly:
“Smart contract risk – While many bridges have successfully passed audits, all it takes is one flaw in a smart contract for assets to be exposed to hacks.” — Ethereum.org bridge documentation.
The sentence captures why audits alone cannot settle the issue. An audit examines a defined codebase under defined assumptions. It does not guarantee that an administrator will configure permissions correctly, that a signer will resist a phishing attempt, or that a third-party dependency will behave as expected. Security improves when the entire operating chain becomes harder to compromise, not merely when a report is attached to a smart contract.
The improvement is therefore cyclical in one sense. The 2022 peak coincided with a period of rapid DeFi expansion, aggressive experimentation and large pools of liquidity. As protocols lost money, some designs were abandoned, audits became more routine and the most obvious vulnerabilities were exploited or fixed. That is a mean-reverting process: immature systems experience a burst of failures, then learn.
But the cycle does not erase the structural problem. The industry’s value is portable, global and often available around the clock. A software defect can be copied across deployments, while a compromised key can authorize transactions within minutes. In traditional finance, layers of legal identity, payment reversibility and institutional settlement can slow a loss or create recovery channels. Crypto’s finality and composability deliver efficiency, but they also compress the time available to detect and reverse an attack.
The second-order effect is easy to miss. Better security at the protocol layer can make the broader ecosystem more attractive, which increases the value stored in the remaining centralized and cross-chain components. Risk does not disappear; it becomes more concentrated. A safer smart contract may encourage more capital to flow into an exchange, bridge or wallet provider that has not improved at the same speed.
That is why aggregate loss figures can rise even while the median protocol becomes safer. The system can have fewer routine exploits and still face larger tail events as assets and balances grow. In risk terms, the distribution is improving in the middle but remaining dangerous at the far end.
The Attack Surface Is Moving From Code to Control
The next phase of crypto security is less about finding one defective function and more about controlling who can authorize a legitimate-looking transaction. Treasury data says North Korean cybercriminals stole $1.5 billion from a digital-asset service provider in February 2025 and at least $2.8 billion in digital assets from January 2024 through September 2025. The scale of those figures shows why private-key security and operational controls now matter as much as open-source code.
The February 2025 Bybit incident illustrates the distinction. Security researchers described the loss as a multisignature phishing exploit, not a failure of the underlying blockchain’s consensus rules. The reported failure involved an approval process being deceived or subverted. That is a different risk class from reentrancy or oracle manipulation, and it requires different defenses: hardware isolation, transaction simulation, independent verification of destination addresses, role separation and rehearsed incident response.
Bybit’s own later recovery update illustrates both the advantage and the limitation of transparent blockchains. The company said it had recovered $48.4 million and had more than $30.5 million frozen across more than 28 exchanges and custodians as of August 2026. Traceability and coordination can recover part of the money. They did not prevent the initial authorization, and recovery remains dependent on counterparties that can identify and freeze the assets.
This is a structural shift in the threat model. Early DeFi failures often centered on code defects that attackers could exploit mechanically. Mature systems attract attackers who manipulate people, suppliers and governance processes. The attack is no longer necessarily “break the contract.” It can be “make the authorized signer believe the contract is being used normally.”
That shift also changes which firms benefit from security spending. Auditors remain important, but the marginal value of another code review may be lower than the marginal value of secure key ceremonies, privileged-access monitoring, vendor controls and rapid coordination with exchanges. Custody providers, compliance teams and forensic analytics become part of the technology stack rather than administrative overhead.
Immunefi’s disclosure data points to another paradox. It says roughly 92.33% of post-launch critical vulnerabilities in crypto are disclosed through its platform, indicating that responsible disclosure and bug bounties are becoming institutionalized. That is progress because incentives can bring flaws to light before exploitation. It also means a large share of known critical weakness is concentrated in a disclosure channel, not necessarily that the universe of undiscovered weaknesses is small.
The industry’s response can thus lower expected losses without eliminating the possibility of catastrophe. A bug bounty is a detection mechanism. A secure signing process is a prevention mechanism. Insurance and reserves are an absorption mechanism. Strong systems need all three.
Control is the bottleneck. The chain may be decentralized, but the points where assets leave a vault, cross a bridge or change hands are often concentrated.
The Counter-Thesis: Losses Are Falling Faster Than Adoption
The strongest case against the structural-risk thesis is not that hacks do not matter. It is that the relevant risk ratio is already improving. If DeFi losses fell 80% from the 2022 peak to 2024 while the ecosystem continued to develop, then the $26.9 billion cumulative figure may be a backward-looking bill from crypto’s experimental phase rather than a forward-looking tax on institutional adoption.
That counter-thesis has real evidence. Immunefi’s bridge-loss share fell from 73% to 3%. Median incident losses fell from $6 million to $1.5 million. Chainalysis’ 2025 analysis said DeFi value locked recovered while hack losses remained suppressed across its 2024–2025 comparison. These are not signs of a system that learns nothing.
Institutionalization can reinforce the trend. Regulated custodians may impose stronger access controls than lightly governed protocols. Larger firms can pay for audits, monitoring and insurance. Stablecoin issuers and tokenized-asset platforms have incentives to protect redemption credibility, because a single security incident can trigger a run. As capital moves toward firms that can demonstrate controls, weak operators may lose liquidity and disappear.
Yet the counter-thesis underestimates scale and concentration. A lower median loss is compatible with a higher maximum loss. Treasury’s reference to the approximately $1.5 billion Bybit theft shows how large a single custody event can be relative to an annual total. When a handful of service compromises account for most losses, the average can remain unstable even as routine protocol security improves.
The counter-thesis also treats adoption as a neutral denominator. More capital does not automatically make a system safer; it increases the reward for compromising the most valuable target. The relevant metric is not simply losses divided by market capitalization. It is losses divided by value secured by each risk class, adjusted for concentration, recoverability and the time required to detect an incident.
Valente’s bank comparison is therefore directionally useful but methodologically incomplete. A 0.24% loss rate against market capitalization cannot be placed beside a 0.017% bank-fraud rate against deposits without qualification. Crypto market capitalization includes assets that may never be used as payment or collateral, while bank deposits are liabilities within institutions designed for custody and settlement. The comparison highlights a burden; it does not prove a precise 14-fold safety gap.
What would falsify the structural-risk judgment? A measurable decline in tail losses would do it. Specifically, if annual losses from exchange, custody, bridge and key-compromise incidents stayed below 0.05% of the value secured by those services for three consecutive years, while the largest single incident remained below 10% of annual losses, the case that concentration remains a structural tax would weaken materially. The signal must be risk-adjusted and category-specific; a lower headline total alone is not enough.
Conversely, a repeat of a billion-dollar custody or bridge event while protocol-level losses continue to fall would confirm the migration thesis. It would show that the industry is not eliminating security risk but moving it to fewer, more valuable control points.
What the Security Tax Means for the Next Cycle
In the short term, security incidents primarily affect sentiment and liquidity. Users withdraw funds, market makers widen spreads, and counterparties raise collateral requirements. The immediate beneficiaries are platforms with transparent reserves, strong custody controls and credible recovery procedures. The exposed are smaller protocols whose liquidity depends on confidence rather than contractual protection.
In the medium term, the consequence is a shift in economics. Protocols and exchanges that can document low incident rates may capture liquidity from competitors, while security spending becomes a revenue-preserving investment rather than a compliance expense. Insurance, monitoring, custody and forensic analytics can take a larger share of ecosystem revenue. That may reduce net margins even as gross transaction activity expands.
In the long term, security determines which parts of crypto become financial infrastructure. Bitcoin’s base-layer settlement model, a regulated stablecoin issuer, a DeFi lending protocol and a cross-chain bridge do not carry the same risk. Treating them as one sector obscures the key distinction: the more a product depends on external signers, wrapped assets, upgrade keys or complex composability, the more its trust assumptions matter.
The base case is gradual improvement with persistent tail risk. Under that scenario, routine DeFi exploits continue to decline, while major custody and social-engineering incidents arrive irregularly. Institutional capital grows, but it concentrates in providers able to demonstrate operational controls rather than simply advertise decentralization.
The upside case requires security improvements to outrun asset growth. For this article’s test, the trigger would be three years in which category-specific losses fall below a proposed 0.05% threshold, no incident exceeds a proposed 10% of annual losses, and recovery mechanisms return a rising share of stolen assets without imposing losses on uninvolved users. That combination would show that the industry is converting learning into resilience.
The downside case is a concentration shock. A second billion-dollar custody or bridge compromise, especially one that causes losses at multiple counterparties, would raise funding costs and accelerate migration toward regulated intermediaries. It would also challenge the claim that decentralization protects users when the operational control layer remains concentrated.
The $26.9 billion estimate should therefore be read neither as a verdict that crypto is unusable nor as a statistic to be waved away because some loss categories are improving. It is a measure of the cost of building a new financial system while its control points are still evolving. The cyclical component is the decline in immature protocol exploits. The structural component is the persistence of concentrated authorization risk.
Crypto’s next competitive advantage will not be the absence of hacks; it will be the ability to make a hack smaller, rarer, faster to detect and easier to recover from. Until that becomes measurable across custody and cross-chain infrastructure, security remains a tax on adoption—not a footnote to it.
Data cutoff: Nov. 12, 2026, UTC.
Explore more exclusive insights at nextfin.ai.
