Hackers inflicted about $1.18 billion in losses on digital asset tasks and platforms within the third quarter of 2026, a 55% quarter-over-quarter improve, in response to a quarterly report by blockchain safety agency Hacken. Almost four-fifths of the losses had been linked to assault vectors falling exterior the scope of the newest safety opinions.
The outcomes elevate questions concerning the diploma of safety buyers and customers can count on from an “audited” label. Losses had been additionally concentrated in a handful of main incidents, indicating that probably the most extreme dangers lie in programs with entry to and authority to maneuver property.
A handful of incidents drove most Q3 losses
Hacken recorded 107 incidents in Q3, however the majority of losses had been concentrated in a small variety of assaults. 4 incidents exceeding $100 million resulted in a mixed lack of $941.5 million, accounting for practically 80% of the quarter’s whole. The median loss throughout all incidents was simply $670,000, exhibiting that the general improve was pushed primarily by exceptionally massive safety occasions.
Bitget suffered the most important assault on Sept. 24, with $387.5 million stolen in response to Hacken’s metrics. In line with Bitget’s investigation replace, the attacker exploited a vulnerability in a third-party safety product to steal inside credentials and forge withdrawal requests. Bitget acknowledged that its personal keys and chilly wallets weren’t compromised.
Liquid Community ranked second, with roughly $319 million affected on Sept. 6. A bug within the rangeproof verification cache of the Parts software program allowed the attacker to mint practically 4,000 unbacked L-BTC, which had been then exchanged for actual BTC by way of the peg-out course of.
Tectonic, a lending protocol on Cronos, recorded $120.4 million in borrowed worth stemming from price-manipulated collateral. This determine represents the worth impacted earlier than the blockchain was rolled again, not the ultimate loss. The Coldcard incident was estimated by Hacken at round $115 million, involving a firmware bug that diminished the entropy of sure Bitcoin seeds.
High 10 largest loss incidents in Q3 2026. Supply: Hacken
Most losses fell exterior the newest safety opinions
In line with Hacken, $906.8 million or 77% of the quarter’s losses had been linked to vendor software program, public code fixes revealed earlier than vulnerabilities had been totally addressed, or elements falling exterior the scope of the newest safety evaluate.
Distributors and improvement instruments accounted for $411.5 million. Bitget alone contributed $387.5 million to this determine. The rest got here from AFX Commerce, a bridge that misplaced $24 million after malware from a Git repository contaminated its improvement setting, permitting attackers to compromise 5 out of seven validators.
Hacken categorized 4 incidents accounting for $324.8 million in losses into the group the place fixes had been publicly disclosed previous to the assault. At Liquid Community, a public repair on Sept. 1 left a bug in how cache keys had been generated, in response to Blockstream’s technical evaluation. The remaining vulnerability was exploited on Sept. 6, earlier than a whole patch was launched.
Roughly $170.5 million got here from elements not included in the newest evaluate. Tectonic had undergone 4 audits, however these reviews didn’t decide whether or not TONIC collateral parameters had been protected underneath real-world liquidity circumstances.
“The problem is at all times scope,” Hacken co-founder Andrii Matiukhin informed CoinDesk. In line with him, an audit badge doesn’t mechanically cowl wallets, transaction-signing programs, third-party software program, or adjustments deployed after the evaluate.
Operators lined $410 million in consumer losses
Roughly $387 million or 33% of the quarter’s losses was recovered or reversed. Operators spent a further $410 million of their very own funds to compensate customers, whereas $384 million stays unrecovered or unpaid, in response to Hacken.
At Liquid Community, the attacker claimed to be a white hat and returned 3,400 BTC, price roughly $272 million on the time. Blockstream acknowledged that round 602 BTC has not been recovered.
Cronos validators additionally rolled again 10,961 blocks following the Tectonic incident, reversing roughly $111.2 million out of the $120.4 million affected. About $9.19 million left the community earlier than the blockchain was halted and was not recovered.
Bitget utilized its Consumer Safety Fund to cowl $387.5 million for customers. Triple-A, Coinsbuy, and TAC compensated a mixed whole of round $22 million. Hacken categorised these funds as operator protection as a result of consumer balances had been protected, though the stolen property weren’t recovered.
Different estimates put Q3 losses increased
CertiK recorded roughly $1.28 billion in losses throughout 268 incidents in Q3, increased than Hacken’s $1.18 billion throughout 107 incidents. After deducting frozen or returned property, CertiK’s adjusted loss stood at round $877.8 million.
The disparity stems from monitoring scopes and incident classification methodologies. Safety companies apply completely different standards for phishing, scams, pockets compromises, and technical exploits. Loss thresholds, asset valuation timing, and accounting of returned funds can even alter the figures.
Regardless of methodological variations, each datasets place Bitget and Liquid Community among the many quarter’s costliest safety incidents.
