Cryptocurrency hacks soared to $1.18 billion across 107 recorded incidents in the third quarter of 2026, according to security company Hacken.
Hacken’s Q3 report attributed 77% (about $906 million) to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, or other components outside security reviews.
The four largest incidents included the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, associated with an estimated $115 million in losses.
This Q3 was the most damaging quarter for crypto hacks since Q1 2025, when Bybit’s $1.4 billion loss to North Korea pushed the total to $1.6 billion.
Q3 losses in total amount and composition. Source: Hacken
About 80% of the quarter’s losses were concentrated in four of the largest incidents, while 98 of the incidents recorded losses below $10 million. The median loss across all 107 incidents was $670,000.
While supplier compromises and infrastructure failures drove much of the stolen value, smart contract incidents were the most frequent, accounting for $228 million in losses across 71 incidents as the most exploited attack vector.
Related: Anthropic warns ‘AI worms’ may autonomously spread across devices like a virus
About a third of losses was returned or reversed after Q3 crypto hacks
Of the $1.18 billion lost, about $387 million was returned or reversed, accounting for the recovery of about 33% of gross losses.
Following the Liquid Network hack, self-proclaimed “white hats” returned $272 million, representing about 85% of the stolen value.
In the Tectonic incident, Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Also, stablecoin issuers Circle and Tether froze about $340,000 tied to the Bitget theft.
Operators covered an additional $410 million of user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million, making users whole, while stolen assets remained with attackers.
About $384 million, or 32% of gross losses, was neither returned nor covered.
Amount of losses covered by operators, compared to amount returned or reversed. Source: Hacken
Hacken urged industry participants to strengthen the cybersecurity of third-party suppliers, developer tools and other external infrastructure that may fall outside security audits.
The company also recommended that protocols expand security audits to include oracles, bridgers, custody systems, signing authorities and other privileged components.
Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer
