Crypto security breaches caused 1.18 billion dollars in Q3 2026 losses across 107 documented incidents, according to a report published by Hacken. The total marked the highest quarterly loss since Q1 2025.
Supply-chain vulnerabilities, compromised developer utilities, and unpatched deployments accounted for 906 million dollars, representing roughly 77% of all stolen value. Four major incidents concentrated 80% of the quarter’s gross financial losses.
The attack against Bitget represented the largest event, totaling 387 million dollars. Following the containment of unauthorized wallet transfers, the exchange stabilized systems and resumed bitcoin withdrawals to restore platform operations.
Liquid Network recorded the second-largest loss at 320 million dollars. Other major exploits included the 120 million dollar breach on lending protocol Tectonic and an estimated 115 million dollar firmware vulnerability impacting Coldcard devices.
Attack vectors differed significantly between asset value and event frequency. Smart contract exploits remained the most common vector, generating 228 million dollars across 71 distinct incidents, while infrastructure compromises drove the bulk of stolen capital.
Across all 107 incidents, the median loss was 670,000 dollars, with 98 cases remaining below the 10 million dollar mark. Broader exchange security frameworks, including the UEX security standard, have been introduced to address third-party supplier vulnerabilities and off-chain risks.
Approximately 33% of gross losses, totaling 387 million dollars, was returned or reversed. White-hat actors returned 272 million dollars following the Liquid Network compromise, recovering about 85% of stolen assets.
Cronos blockchain validators rolled back 114 minutes of settled history during the Tectonic exploit, reversing 111.2 million dollars in affected borrowing. In addition, centralized stablecoin issuers froze 340,000 dollars linked to the Bitget incident.
Platform operators reimbursed an additional 410 million dollars directly to affected users. Bitget’s protection reserve covered 387 million dollars, while Triple-A, Coinsbuy, and TAC disbursed a combined 22 million dollars.
Unrecovered capital totaled 384 million dollars, or roughly 32% of quarterly losses. Hacken advised market protocols to expand formal audits toward signing authorities, custody architecture, and third-party dependencies.
This article is for informational purposes only and does not constitute financial advice.
