Hacken says crypto hacks cost $1.18bn in Q3, up 55% from Q2

In short

• Hacken reported 107 crypto security incidents in Q3 2026 with $1.18bn lost, up 55% from Q2.
• About $906.8m, or 77%, came from suppliers, developer tools, unpatched code and components outside audit scope.
• Bitget lost $387m, Liquid Network $320m, Tectonic $120m and Coldcard $115m; operators covered $410m, leaving $384m unrecovered.
• Whitechain and TDB Law on X backed continuous monitoring, and Hacken says security evidence expires in months, not years.

What Hacken's report found

Hacken said on 15 October 2026 that crypto security incidents in the third quarter of 2026 cost $1.18 billion across 107 recorded events, a 55% rise from the second quarter. The blockchain security firm's report found that about $906.8 million, or 77%, of those losses came from compromised suppliers, developer tools, publicly known fixes that were not deployed, and components outside the latest security audit. Hacken warned that this pattern shows a one-off audit is not enough to protect funds.

The four largest hacks

The largest single losses were the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit and a Coldcard firmware vulnerability with an estimated $115 million in losses, according to Cointelegraph's coverage of Hacken's data. The quarter was the most damaging for crypto hacks since Q1 2025, when the Bybit loss to North Korea pushed the total to $1.6 billion. The median loss across all 107 incidents was $670,000, while 98 incidents lost less than $10 million.

Why audits missed 77% of losses

Hacken's report breaks the loss mix down further: smart contract exploits accounted for 48% of losses, up from 12% in Q2, while access control and operational failures made up 40%, down from 88% in Q2. Crucially, 77% of the quarter's losses came from attack paths that crossed the boundary of the last review, such as a compromised supplier or a public fix not yet deployed. Hacken pointed to derivatives platforms and prediction markets that rely on inadequate key management, though no actively exploited vulnerabilities had been found there.

Who covered the losses

Not all of the $1.18 billion stayed lost. About $387 million was returned or reversed, including $272 million recovered by white hats after the Liquid Network hack and $111.2 million reversed when Cronos validators rolled back 114 minutes of history in the Tectonic case, according to Cointelegraph. Operators covered a further $410 million from their own funds, with Bitget's user protection fund absorbing $387 million and Triple-A, Coinsbuy and TAC repaying about $22 million. Hacken's data still leaves about $384 million, or 32% of gross losses, neither returned nor covered.

What security experts said

On X, security teams responded to Hacken's report by backing continuous monitoring. Whitechain (@Whitechain_io) said on X that thinking of security evidence as something that expires is a useful shift. TDB Law (@TDBLaw) said on X that the report makes a strong case for continuous monitoring rather than relying on periodic audits, adding that security teams may need bespoke AI tools to keep up. Hacken's own post had drawn 48 likes and 3,867 views by 13:23 UTC on 18 October 2026.

Hacken urged industry participants to strengthen the cybersecurity of third-party suppliers and developer tools, and to expand security audits to include oracles, bridgers, custody systems, signing authorities and other privileged components. The report also notes that EU financial supervisors have said annual penetration tests and compliance audits may not be enough as AI speeds up exploitation, encouraging continuous vulnerability scanning and dependency monitoring. Hacken's evidence framework spells out the problem: a proof-of-reserves audit is typically relevant for about a month, a SOC 2 Type II report for about a year, and a smart contract audit for up to two years.

Questions readers ask

What did Hacken's Q3 2026 crypto security report find?

Hacken recorded 107 security incidents in Q3 2026 with $1.18bn lost, up 55% from Q2. About $906.8m, or 77%, involved compromised suppliers, developer tools, unpatched known vulnerabilities and components outside audit scope.

Which crypto hacks were largest in Q3 2026?

The largest were Bitget at $387m, Liquid Network at $320m, Tectonic at $120m and a Coldcard firmware vulnerability estimated at $115m, according to Cointelegraph.

Did users get their money back after the Q3 crypto hacks?

About $387m was returned or reversed, and operators covered about $410m from their own funds, including Bitget's user protection fund covering $387m. About $384m was neither returned nor covered.

Why does Hacken say audits are not enough for crypto security?

Hacken says most Q3 losses came from attack paths outside the last audit, and security evidence expires quickly: a proof-of-reserves audit is relevant for about a month, a SOC 2 Type II report for about a year, and a smart contract audit up to two years.

Our view

Crypto's audit badge is no longer a durable security guarantee. Hacken's Q3 2026 data makes that plain: $1.18bn was stolen across 107 incidents, and 77% of the losses came from vendors, developer tools or components outside the last audit. In my view, the industry's bigger risk ahead is AI-driven attack acceleration. EU supervisors have already said annual penetration tests may not be enough as AI speeds exploitation, and Hacken itself notes that a proof-of-reserves audit is typically relevant for only about a month. A certificate taken once creates false confidence; continuous vulnerability scanning and dependency monitoring must become standard.

The test will be Hacken's next quarterly report. If Q4 losses from unpatched code and unaudited infrastructure fall, it would show that projects have shifted from periodic reviews to continuous defence. If they do not, the 55% quarterly jump will look less like a spike and more like a trend.

Follow the latest updates as they happen on NewsFeeds.

— Ishu Aggarwal