Quick answer: Crypto hacks took $1,180.8 million across 107 incidents in Q3 2026, up 55% from Q2, Hacken’s quarterly report shows. About 77%, or $906.8 million, came through a hacked supplier or developer tool, a public fix that was not yet deployed, or a component outside the latest security review.
Crypto hacks drained $1.18 billion from the industry between July and September 2026, a 55% jump on the second quarter, according to security firm Hacken. The bigger finding is where the money leaked: 77% of it came through systems that the latest audits never looked at, or through fixes that were public but not yet installed.
What the Q3 crypto hacks report found
Hacken published its Q3 2026 Security and Compliance Report on Oct. 15. It counts $1,180.8 million lost in 107 incidents, against $763.97 million in Q2. An independent dataset from Oak Security points the same way. It puts Q3 at roughly $1.07 billion, the costliest quarter since Bybit’s hack in early 2025.
However, most of the damage came from a handful of events. The four largest incidents carried 80% of all losses:
- Bitget: $387.5 million, through a flaw in a third-party security product.
- Liquid Network: $319 million, through a range-proof cache bug.
- Tectonic on Cronos: $120 million, through price manipulation of its own token.
- Coldcard: about $115 million, after firmware fell back to a predictable random number generator.
By contrast, the typical case was small. The median loss was just $670,000, and 98 incidents lost under $10 million each.
The audit gap behind most crypto hacks
Hacken sorted $906.8 million of the losses into three routes. First, compromised suppliers or developer tools took $411.5 million in just two cases, Bitget and AFX Trade. Second, public fixes that were exploited before teams deployed them cost $324.8 million. Third, components outside the most recent review cost $170.5 million across five cases.
“The problem is always scope,” Hacken co-founder Andrii Matiukhin told CoinDesk. He said users see an audit badge and “assume the whole system is covered.”
Several cases show why. For example, Tectonic’s code had four audits, yet its published borrow cap of zero meant no cap at all. Likewise, in the Cosmos EVM case, a fix sat in a public repository for 96 days before chains got release tags. Then the first attack started less than 12 hours after a fork described the exploit path.
Why the incident count looks worse than it is
One headline number needs care. The jump from 67 to 107 incidents is not like for like. Hacken’s Q2 tally only included incidents of $250,000 or more. On that same basis, Q3 had 68, almost the same as Q2.
In other words, attacks did not become far more frequent. Instead, a few very large failures in infrastructure made the quarter expensive. That matters for readers who track these figures over time.
At the same time, the chain data adds a twist. Ethereum, its layer-2 networks and BNB Chain had 59 of the 107 incidents, but only $101.7 million, or 9% of losses. Meanwhile, Bitcoin and Bitcoin layers lost $436.9 million in five incidents, 37% of the total.
How much money came back?
Overall, recovery was better than usual, although it depended on luck. Some $387 million, about 33%, was returned or reversed. Most of that came from the Liquid attacker, who returned about 3,400 BTC and kept 598.5 BTC as a self-declared bounty. At CoinGecko’s price of $81,437 at 13:57 UTC on Oct. 18, that retained BTC is worth about $48.7 million today.
Cronos also rolled back 114 minutes of chain history and reversed $111.2 million of the Tectonic borrowing. Separately, operators paid users about $410 million from their own funds, led by Bitget’s $387.5 million user protection fund. That still leaves about $384 million, or 32% of gross losses, neither returned nor covered.
By comparison, Coldcard users had no such cushion. Galaxy Research ties 1,789.28 BTC across 8,865 addresses to that flaw, Hacken says. At today’s price, those coins are worth about $145.7 million.
Crypto hacks in Q4 so far
The fourth quarter has not been quiet either. CryptoVank has covered the Autheo THEO exploit, the Pirate Chain mint bug and the Cysic bridge mint. Each one created tokens through a bridge or protocol path rather than a simple wallet hack. Similarly, the Ledger tampered-device theft shows how supply-chain risk can reach hardware too.
What to watch next
Hacken also reviewed 12 derivatives exchanges and prediction markets. It found that more than $700 million of user assets at two major venues sits behind a 3-of-4 key setup or admin keys whose holders are not public. Still, it did not name them, and it found no live bug.
So, for users, three checks help. Look at what an audit actually covered, including its date and code version. Next, check who holds admin and upgrade keys. Finally, keep long-term savings in a wallet you control, as our self-custody setup guide explains.
Crypto Hacks FAQ
How much was lost to crypto hacks in Q3 2026?
Hacken counts $1,180.8 million lost across 107 incidents between July and September 2026, up 55% from $763.97 million in Q2. Oak Security’s separate, filtered dataset puts the quarter at about $1.07 billion.
Does an audit mean a crypto project is safe?
No. An audit covers a set scope at one point in time. Hacken found that 77% of Q3 losses came through suppliers, unpatched public fixes or parts outside the latest review.
Were the stolen funds recovered?
Partly. About $387 million, or 33%, was returned or reversed, and operators covered about $410 million from their own funds. Roughly $384 million, or 32%, was neither returned nor covered.
Sources
- Hacken: Q3 2026 Security and Compliance Report (Oct. 15, 2026)
- Hacken: full Q3 2026 report (PDF)
- CoinDesk: Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion
- Cointelegraph: Bitget, Liquid exploits push Q3 crypto hacks toward $1.2B
- Oak Security: The audit gap, updated for Q3 2026
- CoinGecko: Bitcoin price
This article is for information only and is not financial advice. Loss figures come from security firms and may be revised; always do your own research.
