Security firm Hacken reported that cryptocurrency hacks resulted in $1.18 billion in losses across 107 recorded incidents during the third quarter of 2026. This figure marks the most damaging period for crypto security since the first quarter of 2025, when a $1.4 billion loss at Bybit drove total quarterly losses to $1.6 billion.
The report attributes 77% of the stolen value, approximately $906 million, to compromised suppliers, developer tools, or other external components that fell outside standard security reviews. The four largest incidents accounted for roughly 80% of the quarter's total losses. These included the Bitget hack with $387 million in losses, the Liquid Network exploit totaling $320 million, the Tectonic exploit at $120 million, and a Coldcard firmware vulnerability associated with an estimated $115 million in damages. While smart contract exploits were the most frequent attack vector, causing $228 million in losses across 71 incidents, infrastructure failures drove the majority of the financial impact.
Recovery efforts mitigated some of the damage. Approximately $387 million, or 33% of gross losses, was returned or reversed. Following the Liquid Network breach, self-proclaimed "white hats" returned $272 million, representing about 85% of the stolen funds. In the Tectonic incident, Cronos validators rolled back 114 minutes of blockchain history to reverse $111.2 million of affected borrowing. Additionally, stablecoin issuers Circle and Tether froze about $340,000 linked to the Bitget theft. Operators covered another $410 million from their own funds, including Bitget’s user protection fund which reimbursed $387 million. Despite these measures, about $384 million, or 32% of gross losses, remained unrecovered.
The concentration of losses in supply chain and infrastructure vulnerabilities highlights a critical gap in current security protocols. While smart contract audits remain standard practice, the data indicates that attackers are increasingly targeting peripheral systems such as developer tools and third-party suppliers. This shift suggests that traditional perimeter defenses are insufficient against sophisticated actors who exploit unmonitored dependencies. The fact that nearly 80% of losses stemmed from just four major incidents underscores the systemic risk posed by single points of failure in custody and network operations.
From an Operational Risk perspective, the partial recovery of funds through operator intervention and validator rollbacks demonstrates the resilience of centralized entities but raises questions about decentralization principles. The reliance on "white hat" returns and internal compensation funds may mask underlying structural weaknesses rather than resolving them. Industry participants must expand security audits to include privileged components like oracles and signing authorities, as recommended by Hacken. Failure to address these external vectors could lead to further erosion of trust, particularly if future incidents result in higher unrecovered losses due to less cooperative attacker behavior or technical barriers to reversal.
