Cryptocurrency hacks caused $1.18 billion in losses across 107 recorded incidents in the third quarter of 2026, according to security company Hacken.
In its Q3 report, Hacken said about 77% of the total, roughly $906 million, stemmed from compromised suppliers or developer tools, publicly disclosed fixes that had not yet been deployed, or other components outside security reviews.
Four incidents accounted for most of the damage
The four largest cases in the quarter were the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, which was associated with an estimated $115 million in losses.
Hacken said the quarter was the most damaging for crypto hacks since the first quarter of 2025, when Bybit’s $1.4 billion loss to North Korea pushed the total for that period to $1.6 billion.
About 80% of Q3 losses were concentrated in the four biggest incidents. At the same time, 98 of the 107 incidents involved losses below $10 million. The median loss across all incidents was $670,000.
Supplier compromises and infrastructure failures drove most of the stolen value, but smart contract incidents were the most common attack vector by count. Hacken recorded 71 such incidents, with combined losses of $228 million.
Roughly one-third of losses were returned or reversed
Of the $1.18 billion lost during the quarter, about $387 million was returned or reversed, equal to around 33% of gross losses.
After the Liquid Network hack, self-described white hats returned $272 million, or about 85% of the stolen value.
In the Tectonic case, Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million out of $120.4 million in affected borrowing. Circle and Tether also froze about $340,000 tied to the Bitget theft.
Operators covered another $410 million of user losses using their own funds. Bitget’s user protection fund accounted for $387 million of that amount, while Triple-A, Coinsbuy and TAC repaid about $22 million in total. Users were made whole in those cases, but the stolen assets remained with attackers.
Hacken said about $384 million, or 32% of gross losses, was neither returned nor covered by operators.
Hacken calls for broader security reviews
The company urged industry participants to strengthen cybersecurity around third-party suppliers, developer tools and other external infrastructure that may fall outside standard security audits.
It also recommended that protocols widen the scope of their reviews to include oracles, bridgers, custody systems, signing authorities and other privileged components.