Q3 2026 Sees $1.18 Billion Lost to Crypto Hacks

In the third quarter of 2026, losses from cryptocurrency hacks reached an astonishing $1.18 billion, marking a 55% increase from the previous quarter, according to a recent report by blockchain security company Hacken. Alarmingly, most of these losses were tied to vulnerabilities that went unnoticed by recent security audits.

Key Incidents Behind the Losses

During this period, there were 107 reported hacking incidents. However, the bulk of the financial impact stemmed from just a few major attacks, with four incidents alone surpassing $100 million in losses, accounting for nearly 80% of the total amount lost. The median loss for all incidents was relatively modest at $670,000, indicating that the sharp rise in total losses can largely be attributed to several large-scale breaches.

The most substantial breach occurred on September 24, when Bitget was hit with a staggering $387.5 million theft due to a flaw in a third-party security tool. This allowed attackers to gain access to internal credentials and manipulate withdrawal requests, although Bitget confirmed that their private keys and cold wallets remained secure.

Another serious incident happened on September 6, when Liquid Network faced losses of approximately $319 million. The attack exploited a bug in the Elements software that enabled the creation of nearly 4,000 unbacked L-BTC, which were then converted to real BTC.

Tectonic, linked to the Cronos blockchain, reported a loss of around $120.4 million from price manipulation involving its collateral. This was the estimated value before a rollback took place, which mitigated some of the damage. Finally, a firmware bug in the Coldcard project was pegged at around $115 million, impacting Bitcoin seed generation.

Vulnerabilities Beyond Recent Audits

Hacken's findings revealed that $906.8 million, or 77% of total losses, were attributed to vulnerabilities in vendor software, public code that hadn't been fully patched, or components overlooked during the latest security assessment.

Specifically, approximately $411.5 million in losses were tied to vendor and development tools, with Bitget accounting for a significant portion of this amount. For instance, AFX Trade's bridge was compromised, resulting in a $24 million loss due to malware that infiltrated its development environment.

Substantial portions of the losses, totaling $324.8 million, occurred where public fixes had been issued before the attack. For example, Liquid Network suffered from an unresolved bug that persisted despite a fix being made public earlier in September.

About $170.5 million in losses came from components that were not included in recent security assessments. Tectonic, despite undergoing multiple audits, failed to analyze whether its collateral parameters were robust given real-world liquidity conditions.

Recovery Efforts and User Compensation

Interestingly, approximately $387 million, about 33% of the total losses, was either recovered or reversed through various means. Operators collectively spent an additional $410 million to reimburse users, while around $384 million remained unrecovered at the quarter's close.

In a notable recovery, the alleged white hat hacker at Liquid Network returned 3,400 BTC valued at roughly $272 million. However, not all funds were retrievable, with Blockstream still working to recover around 602 BTC.

Post-attack, the Cronos team executed a rollback of 10,961 blocks, effectively reversing nearly $111.2 million of the $120.4 million linked to Tectonic. Unfortunately, around $9.19 million had already exited the network and could not be reclaimed.

Bitget used its User Protection Fund to cover the complete $387.5 million loss for its users. Other entities such as Triple-A and Coinsbuy combined for an additional reimbursement of around $22 million. These compensations, although not recovering the stolen assets, showed the operators' commitment to protecting user balances.

Alternative Loss Estimates

While Hacken reported total Q3 losses at $1.18 billion over 107 incidents, CertiK's figures suggested even higher losses of approximately $1.28 billion across 268 incidents during the same time frame. After accounting for frozen returns, CertiK adjusted its reported loss to about $877.8 million.

The discrepancies between the two reports arise from differences in how incidents are classified and the methodologies employed to track various types of losses. Despite these differences, both reports highlight Bitget and Liquid Network as major incidents from that quarter, showcasing ongoing vulnerabilities in the cryptocurrency space.