The third quarter of 2026 turned out to be the worst stretch for crypto security since early 2025. Blockchain security firm Hacken tallied 107 separate incidents that drained $1.18 billion from the industry — a 55% jump from the previous quarter. Only the first quarter of 2025, with its $1.6 billion in losses, was worse.
Four incidents alone accounted for 80% of the damage:
- Bitget — roughly $387 million, through compromised third-party infrastructure;
- Liquid Network — about $320 million;
- the Tectonic protocol — $120 million;
- a firmware flaw in the Coldcard hardware wallet — around $115 million.
The remaining 103 incidents were far smaller — the median loss came to just $670,000. It's the sheer number of small cracks, not one single disaster, that adds up.
The report's real finding is uglier than the headline number. Hacken found that 77% of losses — $906 million — came from things no standard audit ever checks: vulnerable third-party vendors, fixes that were written but never deployed, and infrastructure nobody bothered to review. An 'audited' badge on a project's website, in other words, says less and less about whether user funds are actually safe — it covers the contract code, not the signing keys, the partners' servers, or the update process.
The nature of the attacks shifted too. Where weak access controls — stolen private keys, compromised admin panels — used to account for 88% of losses, that share fell to 40% this quarter. Smart contract bugs took over instead, showing up in 71 of the 107 incidents and causing $228 million in damage.
Not everything was lost for good. Projects clawed back $387 million — a third of the total. White-hat hackers voluntarily returned $272 million taken from Liquid Network, 85% of what was stolen there. Cronos validators went further, rolling back the chain by 114 minutes to recover $111 million drained through Tectonic. Operators covered another $410 million out of their own reserves. That leaves $384 million — nearly a third of the total — still sitting with the attackers.
