Liquid

Cronos

Cryptocurrency

Tectonic

Bitcoin

Cryptocurrency hacks soared to $1.18 billion across 107 recorded incidents in the third quarter of 2026, according to security company Hacken.
Hacken’s <a href="https://hacken.io/insights/q3-2026-report/" rel="noopener noreferrer nofollow">Q3 report</a> attributed 77% (about $906 million) to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, or other components outside security reviews.
The four largest incidents included the $387 million <a href="https://cointelegraph.com/news/bitget-calls-security-withdrawal-claims-unverified-amid-178m-breach-reports" rel="noopener noreferrer nofollow">Bitget hack</a>, the $320 million <a href="https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit" rel="noopener noreferrer nofollow">Liquid Network exploit</a>, the $120 million <a href="https://cointelegraph.com/news/cronos-tectonic-rollback-111m-9m-escaped" rel="noopener noreferrer nofollow">Tectonic exploit,</a> and the <a href="https://cointelegraph.com/news/coldcard-third-wave-attacker-moves-bitcoin-stolen" rel="noopener noreferrer nofollow">Coldcard firmware vulnerability,</a> associated with an estimated $115 million in losses.
This Q3 was the most damaging quarter for crypto hacks since Q1 2025, when <a href="https://cointelegraph.com/news/chainalysis-bybit-hack-breakdown-1-4-billion" rel="noopener noreferrer nofollow">Bybit’s $1.4 billion loss to North Korea</a> pushed <a href="https://cointelegraph.com/news/crypto-hack-losses-q1-2025-peckshield" rel="noopener noreferrer nofollow">the total to $1.6 billion</a>.
<img src="https://s3-images.ctmedia.io/media/content/2026/10/01M4ZAQRY4CA399WFQJF63BZF0/pasted-image-2825.png" alt="" width="1112" height="643">
Q3 losses in total amount and composition. Source: Hacken
About 80% of the quarter’s losses were concentrated in four of the largest incidents, while 98 of the incidents recorded losses below $10 million. The median loss across all 107 incidents was $670,000.
While supplier compromises and infrastructure failures drove much of the stolen value, smart contract incidents were the most frequent, accounting for $228 million in losses across 71 incidents as the most exploited attack vector.
Related: <a href="https://cointelegraph.com/news/anthropic-ai-worms-autonomously-spread-devices-virus" rel="noopener noreferrer nofollow">Anthropic warns ‘AI worms’ may autonomously spread across devices like a virus</a>
<h2 id="about-a-third-of-losses-was-returned-or-reversed-after-q3-crypto-hacks">About a third of losses was returned or reversed after Q3 crypto hacks</h2>
Of the $1.18 billion lost, about $387 million was returned or reversed, accounting for the recovery of about 33% of gross losses.
Following the Liquid Network hack, self-proclaimed “white hats” <a href="https://cointelegraph.com/news/liquid-white-hats-return-270m-bitcoin-network-restart" rel="noopener noreferrer nofollow">returned $272 million</a>, representing about 85% of the stolen value.
In the Tectonic incident, Cronos <a href="https://cointelegraph.com/news/cronos-network-halt-tectonic-exploit-75-million" rel="noopener noreferrer nofollow">validators rolled back</a> 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Also, stablecoin issuers Circle and Tether froze about $340,000 tied to the Bitget theft.
Operators covered an additional $410 million of user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million, making users whole, while stolen assets remained with attackers.
About $384 million, or 32% of gross losses, was neither returned nor covered.
<img src="https://s3-images.ctmedia.io/media/content/2026/10/01M4ZAR5ZB3R8EEKZMK552ENYF/pasted-image-2826.png" alt="" width="1445" height="385">
Amount of losses covered by operators, compared to amount returned or reversed. Source: Hacken
Hacken urged industry participants to strengthen the cybersecurity of third-party suppliers, developer tools and other external infrastructure that may fall outside security audits.
The company also recommended that protocols expand security audits to include oracles, bridgers, custody systems, signing authorities and other privileged components.
Magazine: <a href="https://cointelegraph.com/features/crypto-coercion-attack-fake-police-raid" rel="noopener noreferrer nofollow">Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer</a>

Bitget, Liquid exploits push Q3 crypto hacks toward $1.2B

Table of Contents

Cointelegraph

Other articles published on Oct 15, 2026

Join our free newsletter for daily crypto updates!