Crypto hacks cost 1.18 billion dollars in the third quarter, with 77 percent tied to suppliers, developer tools and undeployed fixes

What happened

Cryptocurrency hacks cost 1.18 billion dollars across 107 recorded incidents in the third quarter of 2026, according to a quarterly report from security firm Hacken, making it the most damaging quarter since the first quarter of 2025. The headline figure, though, is not the finding. The finding is where the money was lost. Hacken attributed 77 percent of the losses, about 906 million dollars, to compromised suppliers or developer tools, to publicly disclosed fixes that had not been deployed, or to other components that sit outside the scope of a normal security review. In other words, most of the value stolen in the quarter did not pass through a flaw in the audited code at the centre of a protocol. It came in through the things around the code.

The losses were heavily concentrated. Four incidents accounted for about 80 percent of the total: a 387 million dollar hack at Bitget, a 320 million dollar exploit on the Liquid Network, a 120 million dollar exploit at Tectonic, and a Coldcard firmware vulnerability associated with an estimated 115 million dollars in losses. Against that concentration, the rest of the quarter was a long tail of smaller thefts. Ninety eight of the 107 incidents lost less than 10 million dollars each, and the median loss across all incidents was 670,000 dollars. Smart contract attacks were the most frequent category by count, with 71 incidents and 228 million dollars in losses, even though they were not where most of the money was. Frequency and severity pointed in opposite directions: the common attack was a contract exploit of moderate size, while the catastrophic losses came from suppliers, tools and infrastructure.

The comparison Hacken drew was with the first quarter of 2025, when a 1.4 billion dollar loss at Bybit, attributed to North Korea, pushed that quarter's total to 1.6 billion dollars. The third quarter of 2026 reached 1.18 billion dollars without a single incident of that size, which is a different kind of bad quarter: not one historic breach, but four large ones in three months, plus the usual background of smaller attacks continuing underneath.

The recovery figures complicate the total in a useful way. About 387 million dollars, roughly 33 percent of gross losses, was returned or reversed after the attacks. In the Liquid Network case, self described white hat actors returned 272 million dollars, about 85 percent of what was taken. In the Tectonic case, validators on the Cronos network rolled back 114 minutes of settled blockchain history, reversing about 111.2 million dollars of the 120.4 million dollars in affected borrowing. Stablecoin issuers Circle and Tether froze about 340,000 dollars tied to the Bitget theft, a small figure that shows how limited freezing is once funds have moved. Separately from returns and reversals, operators covered an additional 410 million dollars of user losses from their own funds. Bitget's user protection fund covered 387 million dollars, and three other operators repaid about 22 million dollars between them, making their users whole while the stolen assets stayed with the attackers. About 384 million dollars, 32 percent of gross losses, was neither returned nor covered.

Hacken's recommendations followed its diagnosis. The firm urged the industry to strengthen the security of third party suppliers, developer tools and other external infrastructure that can fall outside audits, and recommended that protocols expand audit scope to include oracles, bridges, custody systems, signing authorities and other privileged components.

Why it matters

This report lands in the same week as this desk's coverage of the hardware wallet implant case, in which a covert component read recovery phrases off device screens and sent them out over a mobile network. The two stories are the same story at different scales. In each case the cryptography at the centre held, the audited component behaved as designed, and the loss arrived through the surrounding system: a reseller channel and a piece of added hardware in one case, suppliers, developer tools, undeployed patches and out of scope infrastructure in the other. The industry's security model still concentrates its scrutiny, its audits, its bug bounties and its marketing, on the smart contract in the middle. Hacken's 77 percent figure says the money is being lost at the edges of that model.

The undeployed fix category deserves to be read twice. A publicly disclosed fix that has not been deployed means the vulnerability was known, a remedy existed, and the loss happened in the gap between the two. That is not a failure of detection or of research. It is a failure of operations, of patch discipline, of the unglamorous work of shipping a known remedy before someone uses the known hole. It is also the cheapest category of loss in the entire report to prevent, because it requires no new science, only speed.

The recovery numbers cut two ways. A third of gross losses returned or reversed, and another 410 million dollars covered by operators, means the 1.18 billion dollar headline overstates what users ultimately lost in the quarter. But each recovery mechanism carries its own cost to the system's claims about itself. A rollback of 114 minutes of settled history is a deliberate decision that finality is negotiable when the loss is large enough, which may be the right decision and is still a precedent every future victim will cite. A protection fund covering 387 million dollars is a promise kept, and also a reminder that the promise depends on one company's fund being large enough for its worst quarter. White hat returns of 85 percent depend on the goodwill or the calculation of the person who took the funds. None of these mechanisms is a system. Together they are improvisation that happened to work at scale, this time.

Finally, the concentration figure should change how the quarter is discussed. Four incidents produced about 80 percent of the losses, and the median incident cost 670,000 dollars. Averages drawn from this distribution mislead in both directions: the typical hack is a sub million dollar event that most users never hear about, and the quarterly total is set by a handful of failures at the largest venues and networks. Security spending, insurance pricing and regulation that treat the two populations as one problem will misprice both.

What to watch

Watch audit scopes. If major protocols begin publishing audit scopes that explicitly include oracles, bridges, custody systems and signing authorities, as Hacken recommends, the report will have changed practice. If scopes stay centred on core contracts, the next quarterly report will likely find the same 77 percent waiting for it.

Watch patch latency. The disclosed but undeployed fix category is measurable, and any venue or protocol that publishes its time from disclosure to deployment is setting a standard competitors will be asked to meet after the next incident in that category.

Watch protection fund disclosures. Operator coverage of 410 million dollars in one quarter raises the obvious follow on question of fund sizes relative to worst case losses. Whether large venues disclose fund capacity and replenishment after drawing on it will tell users how much of the coverage they saw this quarter is repeatable.

And watch the fourth quarter total against this baseline. The third quarter reached 1.18 billion dollars without a single Bybit scale event. A fourth quarter that falls sharply would suggest the supplier and tooling failures were a cluster. A fourth quarter at a similar level would confirm that the industry's loss rate has reset higher, and that the audit centred model is no longer containing it.