Hacken: Q3 crypto hacks hit $1.18 billion as most losses sat outside audit scope

Summary

Blockchain security firm Hacken’s Q3 2026 report says $1.18 billion was stolen across 107 crypto incidents between July and September, up 55% from Q2, making it one of the costliest quarters on record for digital-asset security.

Hacken attributed about 77% of those losses — roughly $906–$906.8 million in outlet tallies — to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, or components left outside the latest security reviews, and warned that audit badges can create a false sense of security when wallets, signing systems and third-party software are never tested.

CoinDesk and Cointelegraph both cover the report; outlets differ slightly on the largest incidents (CoinDesk put Bitget at “at least $352 million,” while Cointelegraph cited a $387 million Bitget figure alongside Liquid Network, Tectonic and Coldcard losses).

Cointelegraph, citing Hacken, also said about $387 million of the $1.18 billion was returned or reversed (about 33%), operators covered another $410 million of user losses from their own funds, and about $384 million (32%) was neither returned nor covered.

Key facts

• Hacken said Q3 2026 saw $1.18B stolen across 107 incidents, up 55% from Q2, with smart-contract exploits at 48% of losses (up from 12% in Q2) and access-control/operational failures at 40% (down from 88% in Q2). (Hacken)
• Hacken listed among key trends that losses split almost evenly between smart-contract exploits and access-control failures, that public security fixes again preceded several high-profile exploits, and that regulators are testing whether controls hold in continuous operation. (Hacken)
• CoinDesk reported that about $906.8 million of the quarter’s losses stemmed from compromised suppliers or developer tools, uninstalled public fixes, or components excluded from the most recent security review. (CoinDesk)
• CoinDesk quoted Hacken co-founder and board director Andrii Matiukhin: “The problem is always scope… teams cut corners, auditing only critical parts of the service,” and that customers often assume an audit badge covers an entire platform. (CoinDesk)
• CoinDesk said Hacken identified the September Bitget attack — “at least $352 million” after hackers exploited a vulnerability in a third-party security product — as the biggest incident in the period, and also cited Liquid Network (~$319 million), Tectonic (at least $75 million) and Coldcard wallet software (~$114 million). (CoinDesk)
• Cointelegraph put the four largest incidents at $387 million (Bitget), $320 million (Liquid Network), $120 million (Tectonic) and about $115 million (Coldcard firmware) — figures that differ from CoinDesk’s Bitget and Tectonic tallies. (Cointelegraph)
• Cointelegraph said smart-contract incidents were the most frequent vector ($228 million across 71 incidents), that about 80% of losses sat in the four largest cases, that the median loss was $670,000, and that about $387 million was returned or reversed while operators covered another $410 million. (Cointelegraph)