- Hacken recorded 107 crypto security incidents in the third quarter, with estimated losses rising 55% to US$1.18 billion.
- Around US$906.8 million, or 77% of losses, involved compromised suppliers, developer tools, unpatched vulnerabilities or components outside audit scopes.
- Four major incidents involving Bitget, Liquid Network, Tectonic and Coldcard accounted for roughly 80% of reported losses.
- Approximately US$387 million was recovered or reversed and US$410 million reimbursed, leaving around US$384 million neither recovered nor reimbursed.
Crypto projects lost an estimated US$1.18 billion (AU$1.69 billion) to hacks and exploits in the third quarter of 2026, a 55% increase from the previous three months, according to blockchain security firm Hacken.
Its report, released on 15 October, recorded 107 incidents between July and September. But the bigger concern may be where attackers found their way in: much of the money was taken through weaknesses beyond the systems covered by standard security audits.
Hacken linked US$906.8 million (AU$1.43 billion), or roughly 77% of the total, to compromised suppliers and developer tools, known security fixes that had not been installed, or components left out of the most recent reviews.
That doesn’t necessarily mean auditors missed those vulnerabilities. Some weren’t included in the work they were asked to check, while others involved outside services or fixes that project operators had yet to apply.
Related: AI Agents Have Made 138 Million Crypto Payments, Chainalysis Finds
Four Incidents Account for Most Losses
The damage was concentrated in a handful of attacks. The biggest involved crypto exchange Bitget, with around US$387 million (AU$554.66 million) in affected funds, followed by a US$319 million (AU$457.2 million) exploit involving Liquid Network.
A Tectonic exploit accounted for approximately US$120 million (AU$171.98 million), while a Coldcard wallet firmware vulnerability was linked to an estimated US$115 million (AU$164.82 million).
Together, the four incidents represented around 80% of the quarter’s reported losses.
Most attacks were much smaller. Of the 107 incidents recorded, 98 involved less than US$10 million (AU$14.33 million) each, while the median loss was US$670,000 (AU$960,309).
The headline loss figure also doesn’t mean all that money remained missing.
Around US$387 million was returned or reversed across various incidents, while affected businesses covered another US$410 million (AU$587.62 million) from their own funds, including Bitget’s compensation of US$387.5 million (AU$555.38 million). Hacken put the amount neither recovered nor reimbursed at approximately US$384 million (AU$550.39 million).
Read also: Australia Opens Consultation on New Crypto Tax Reporting Laws
Smart contract exploits were the most common type of incident, with 71 attacks accounting for US$228 million (AU$326.78 million) in losses. However, some of the largest financial hits involved external tools and infrastructure rather than flaws in the core code.
The findings highlight a problem for investors relying on a project’s security-audit badge. An audit might cover a particular smart contract at a particular time without examining the wallets, permissions and third-party systems that also control customer funds.
Be the first to comment