Crypto hack losses since 2017 equal 57 cents for every dollar of on-chain revenue, according to an ARK analyst cited by WuBlockchain on November 12, 2026. The reported estimate puts accumulated theft beside the industry's capacity to generate revenue, giving security failures an economic benchmark beyond the size of any individual breach.
At that ratio, cumulative losses amount to more than half the revenue used in the comparison. For investors assessing crypto businesses and protocols, the implication is uncomfortable: an assessment of earning power needs a separate account of the capital lost along the way.
A revenue benchmark changes the comparison
The arithmetic is straightforward. For every hypothetical $100 of on-chain revenue in the calculation, there would be $57 of hack losses. Those amounts illustrate the reported ratio; they are not additional estimates of industry totals.
The comparison needs one qualification. Hack losses divided by revenue is an aggregate historical measure, not a statement that users lost 57% of their deposits or that every protocol surrendered the same share of its earnings. WuBlockchain's brief report does not provide the underlying definitions or calculation, so the figure should remain attributed to the analyst.
Revenue and stolen capital also describe different economic events. A revenue dollar records income. A stolen dollar measures an asset loss that may fall on someone other than the entity earning that income. Subtracting 57 cents from a dollar therefore would not produce an industry profit margin.
The useful analytical question is whether the businesses generating income also bear the consequences when security fails. A revenue model can look attractive to its operator while leaving users exposed to losses. Evaluating both sides requires attention to who holds assets and who absorbs a shortfall.
Security spending competes with the cost of failure
The estimate gives investors a reason to examine security expenditure alongside reported revenue. Analysis of a protocol's economics should ask whether its income supports the controls needed to protect the assets entrusted to it.
A security budget, however, needs to address the particular ways funds can leave without authorization. Historical losses cannot tell a developer exactly how much to spend, and a larger budget alone is no measure of effectiveness.
Ethereum's developer guidance identifies access control as one such area. Sensitive contract functions need restrictions on who can execute them. The guidance also describes multisignature administration, which requires approval from multiple accounts before an action proceeds.
Independent review addresses another part of the problem. Ethereum's guidance recommends audits alongside testing, while warning that audits can miss bugs. Treating an audit as one layer of review leaves room to examine the permissions and operational decisions surrounding the code.
For an investor, those details turn a broad assurance about security into concrete questions: which accounts can move funds, and which actions require another person's approval? An audit badge alone answers neither.
Custody decisions need a map of permissions
The Ethereum Foundation's security challenges report describes risks across key management, transaction signing and application permissions. It notes that institutional users must account for employee changes when managing keys. It also warns that unlimited token approvals can expose funds if an approved contract is later compromised.
Those are distinct failure paths. An institution can have a procedure for replacing a departing employee's key while still carrying exposure through an application's existing permission to move tokens.
For users considering options built around self-custody, keeping control of a wallet's keys and granting a contract access to its assets are separate decisions. The report's discussion of approvals highlights a practical concern: an authorization can continue to expose funds after the original interaction.
Investors can put the ARK estimate to use by mapping permissions before comparing promises of security. A custodian or protocol should be able to explain who can authorize transfers and the circumstances in which that authority changes. Institutions evaluating a provider can use those answers to distinguish controls they retain from controls they delegate.
The aggregate ratio supplies the reason to ask. The answers must come from the particular service holding or accessing the assets.
Overview
WuBlockchain reported an ARK analyst's estimate that cumulative crypto hack losses since 2017 equal 57 cents per dollar of on-chain revenue. The figure compares losses with income rather than deposits, making it a measure of economic damage relative to earning power.
Its strongest use is as a prompt to evaluate revenue and asset protection together. Access restrictions, multiple approvals and the scope of application permissions provide concrete subjects for that evaluation. The reported historical benchmark is $0.57 of hack losses for every $1 of on-chain revenue.
