Q3 Crypto Hacks Hit $1.18B as Bitget and Liquid Exploits Dominate Losses

Cryptocurrency hacks surged to $1.18 billion across 107 recorded incidents in the third quarter of 2026, making it the most damaging quarter for crypto security since Q1 2025, when Bybit's $1.4 billion loss to North Korea pushed quarterly totals to $1.6 billion, according to a new report from security firm Hacken. Roughly 77% of losses—approximately $906 million—were tied to compromised suppliers, developer tools, publicly disclosed fixes that had not been deployed, or other infrastructure components outside formal security reviews.

Four incidents accounted for about 80% of the quarter's losses, led by the $387 million Bitget hack and the $320 million Liquid Network exploit, followed by the $120 million Tectonic exploit and a Coldcard firmware vulnerability linked to roughly $115 million in losses. While smart contract incidents were the most frequent attack vector, with $228 million stolen across 71 cases, the median loss across every recorded incident was just $670,000, with 98 incidents posting losses below $10 million.

Roughly $387 million of the stolen total was returned or reversed, representing about 33% recovery. Following the Liquid Network hack, self-proclaimed white hats returned $272 million, or about 85% of the stolen funds, while Cronos validators rolled back 114 minutes of settled blockchain history to reverse $111.2 million of the $120.4 million affected in the Tectonic incident. Stablecoin issuers Circle and Tether froze approximately $340,000 tied to the Bitget theft, and operators including Bitget's user protection fund, Triple-A, Coinsbuy, and TAC covered an additional $410 million from their own treasuries to make users whole. Still, roughly $384 million—about 32% of gross losses—remained neither recovered nor reimbursed. Hacken urged industry participants to strengthen cybersecurity across third-party suppliers and developer tools, which continue to represent the weakest link in the crypto ecosystem.