Cryptocurrency hack losses surged 55% in Q3 2026 to $1.18 billion across 107 incidents, according to security firm Hacken. Compromised third-party suppliers, developer tools, and operational flaws drove 77% of total losses, led by major exploits at Bitget ($388 million) and Liquid Network ($320 million). Security experts warn that audit badges provide a false sense of security because reviews routinely omit critical infrastructure.
Q3 2026 hack statistics
- ▪Smart contract incidents were the most frequent attack vector in Q3 2026, accounting for 71 incidents and $228 million in total losses, according to Hacken.
- ▪The third quarter of 2026 was the most damaging quarter for cryptocurrency hacks since Q1 2025, when total losses reached $1.6 billion.
- ▪Cryptocurrency hack losses rose 55% quarter-over-quarter to $1.18 billion across 107 recorded incidents in Q3 2026, according to a report by security firm Hacken.
- ▪Four major incidents accounted for approximately 80% of total Q3 2026 crypto hack losses, while 98 incidents involved individual losses under $10 million and the median loss was $670,000.
Operator coverage of hack losses
- ▪Approximately $387 million of Q3 2026 crypto hack losses was returned or reversed, while operators covered $410 million from their own funds and $384 million remained unrecovered.
- ▪Crypto operators Triple-A, Coinsbuy, and TAC repaid approximately $22 million from their own funds to make users whole following Q3 2026 hacks.
Hacken analysis on security vulnerabilities
- ▪Hacken's analysis of Q3 2026 figures showed that losses attributed to access-control and operational failures dropped approximately 30% compared to Q2 2026, falling from about $675 million to $472 million.
- ▪Hacken attributed $906.8 million, or 77%, of Q3 2026 crypto losses to compromised suppliers, third-party developer tools, uninstalled security fixes, or components excluded from security reviews.
- ▪Hacken co-founder Andrii Matiukhin warned that audit badges give investors a false sense of security because project teams often cut costs by auditing only smart contracts while excluding wallets, signing systems, and third-party software.
Bitget third-party credential exploit
- ▪Bitget confirmed that its private keys were not compromised and customer account balances remained unaffected because its Protection Fund fully covered the financial impact prior to reopening withdrawals on October 2, 2026.
- ▪Crypto exchange Bitget lost $387 million to $388 million on September 24, 2026 after attackers compromised third-party security software and obtained high-privilege credentials to inject forged withdrawal instructions.
Liquid Network cache defect exploit
- ▪Exchange SideSwap processed Liquid Network's 4,000 LBTC peg-out order automatically without size, velocity, or wallet-history checks, which removed any manual opportunity to hold released Bitcoin after validation failed.
- ▪Liquid Network suffered a $319 million to $320 million exploit in September 2026 after an Elements range-proof cache defect allowed 4,000 unbacked LBTC tokens to bypass validation checks.
- ▪Self-proclaimed white-hat hackers returned 3,400 BTC worth approximately $272 million following the September 2026 Liquid Network exploit, leaving roughly 602 BTC outstanding.
Derivatives exchange security reviews
- ▪Hacken examined 12 derivatives exchanges and prediction markets, finding that over $700 million in secure assets at two major venues depended on a three-of-four key signing arrangement or unpublicized administrative key holders.
- ▪Hacken co-founder Andrii Matiukhin stated that the firm found no evidence of an active vulnerability in any of the reviewed derivatives venues.
Story comments
Loading comments…