Q3 2026 crypto losses hit $1.18 billion

Security firm Hacken reports that cryptocurrency incidents totalled $1.18 billion across 107 cases during the third quarter of 2026. Roughly 77% of that sum — approximately $906 million — stemmed from vulnerabilities in suppliers, developer tooling, publicly disclosed but unpatched flaws, or infrastructure elements that fell outside formal security reviews.

Four episodes accounted for the bulk of the damage: Bitget lost $387 million, Liquid Network suffered a $320 million exploit, Tectonic saw $120 million drained, and a Coldcard firmware weakness led to an estimated $115 million in theft. The quarter ranks as the costliest since the opening three months of 2025, when Bybit's $1.4 billion loss to North Korea drove the period total to $1.6 billion.

Concentration was extreme: the top four incidents alone captured roughly 80% of the quarter's losses, while 98 events registered under $10 million each. The median loss stood at $670,000. Smart contract flaws remained the most common attack surface, responsible for $228 million spread over 71 separate cases, even though supplier and infrastructure breaches claimed the larger share of value.

Recovery and operator intervention reduced net impact

Victims and protocols clawed back or nullified about $387 million, representing 33% of gross losses. White-hat actors returned $272 million following the Liquid Network breach — roughly 85% of what was taken. Cronos validators unwound 114 minutes of finalised chain history after the Tectonic exploit, reversing $111.2 million of the $120.4 million in compromised borrowing positions. Circle and Tether froze approximately $340,000 connected to the Bitget theft.

Operators absorbed an additional $410 million in user losses from their own reserves. Bitget deployed $387 million from its user protection fund, while Triple-A, Coinsbuy and TAC collectively covered around $22 million, ensuring customers remained whole even as stolen assets stayed in attacker hands. Net unrecovered and uncovered losses amounted to $384 million, or 32% of the total.

Hacken called on the industry to harden the cybersecurity posture of third-party suppliers, developer infrastructure and external dependencies that typically escape audit scope. The firm also urged protocols to widen security reviews to encompass oracles, bridge operators, custody arrangements, signing authorities and other components holding elevated privileges.