Cryptocurrency hacks totaled $1.18 billion in the third quarter of 2026, marking the most damaging period since Q1 2025. Security firm Hacken's Q3 report detailed 107 recorded incidents during the quarter.

Approximately 77 percent of these losses—roughly $906 million—stemmed from compromised suppliers, developer tools, or infrastructure components that fell outside standard security audits. Publicly disclosed fixes that remained undeployed also contributed to this figure.

Four incidents concentrated about 80 percent of the quarter's total stolen value. The $387 million Bitget hack led the list, followed by the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and a $115 million Coldcard firmware vulnerability. In contrast, 98 of the 107 incidents recorded individual losses below $10 million, with a median loss of $670,000 across all incidents.

Smart contract incidents were the most frequent attack vector, accounting for $228 million in losses across 71 separate events, despite smaller per-incident totals than supply chain breaches.

Approximately $387 million—about 33 percent of gross losses—was either returned or reversed. Following the Liquid Network hack, self-proclaimed white hats returned $272 million, recovering about 85 percent of stolen funds. In the Tectonic incident, Cronos validators executed a blockchain rollback of 114 minutes, reversing approximately $111.2 million of the $120.4 million in affected borrowing. Stablecoin issuers Circle and Tether froze about $340,000 linked to the Bitget theft.

Operators covered an additional $410 million of user losses directly from their own funds. Bitget's user protection fund covered $387 million of its incident. Triple-A, Coinsbuy, and TAC collectively repaid about $22 million, making users whole despite attackers retaining the stolen assets.

Roughly $384 million—32 percent of gross losses—remained unreturned and uncovered, representing permanent capital drain from the ecosystem.

Hacken urged industry participants to fortify the cybersecurity of third-party suppliers, developer tools, and external infrastructure. The company also recommended that protocols broaden security audits to include critical components like oracles, bridgers, custody systems, and signing authorities.