Crypto hackers took $1.18bn in the third quarter, the worst run since early 2025

Cryptocurrency platforms and their users were left with about $384 million in losses that were neither returned nor covered after a quarter in which hackers took $1.18 billion, according to the security company Hacken. The total came from 107 recorded incidents in the third quarter of 2026.

Hacken attributed 77% of the quarter's losses, about $906 million, to compromised suppliers or developer tools, publicly disclosed fixes that had yet to be deployed, and other parts of the system outside normal security reviews. The findings point to risks in the infrastructure platforms rely on, rather than only in their own systems.

Four large incidents accounted for about 80% of all losses in the quarter. Bitget lost $387 million, Liquid Network lost $320 million, the Tectonic exploit caused $120 million in losses, and a Coldcard firmware vulnerability was associated with an estimated $115 million.

Most recorded incidents were far smaller. Smart contract attacks were the most common route, accounting for $228 million across 71 incidents. Of the 107 incidents, 98 involved losses below $10 million, while the median loss was $670,000.

Some of the money was recovered, reversed or covered by operators. About $387 million of the $1.18 billion lost was returned or reversed, equal to about 33% of gross losses.

After the Liquid Network hack, self-described white hats returned $272 million, about 85% of the value stolen. Circle and Tether froze about $340,000 linked to the Bitget theft, while Bitget's user protection fund covered $387 million.

Operators also covered an additional $410 million of user losses from their own funds. Triple-A, Coinsbuy and TAC repaid about $22 million to users.

In the Tectonic case, Cronos validators rolled back 114 minutes of settled blockchain history. That reversed about $111.2 million of the $120.4 million in affected borrowing.

The third quarter was the most damaging for crypto hacks since the first quarter of 2025, when Bybit's $1.4 billion loss to North Korea brought the total for that period to $1.6 billion.

Across 288 documented attacks through late September in 2026, the industry lost $2.2 billion to theft, exploits and social engineering. Hacken said the year's largest events had involved long reconnaissance periods, multi-stage attack chains and, in several documented cases, artificial intelligence-assisted code analysis used to find edge cases.