Bitget, Liquid Exploits, Crypto Hacks Push Q3 Losses to $1.2 Billion
According to Hacken, compromised suppliers, developer tools, and infrastructure components outside security audits accounted for about 77% of total losses in the quarter.
Compromised vendors, developer tools and infrastructure components outside of security audits accounted for about 77 percent of the total loss for the quarter, Hacken said.
Hacking of digital currencies increased to $1.18 billion in 107 recorded incidents in the third quarter of 2026, according to a report by security firm Hacken.
Hacken's third-quarter report attributed 77% (about $906 million) to vendors or developer tools at risk, publicly disclosed fixes that were not deployed, or other components outside of security checks.
The four major incidents were the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard operating system vulnerability, which cost an estimated $115 million in losses.
The quarter was the most damaging quarter for crypto hacking since the first quarter of 2025, when Bybit's $1.4 billion loss to North Korea brought the total to $1.6 billion.
Q3 loss in total amount and composition. Source: Hacken
About 80 percent of the quarter's losses were concentrated in the four largest incidents, while 98 incidents recorded losses below $10 million. The average loss across all 107 incidents was $670,000.
While supplier compromises and infrastructure failures increased the value of theft, smart contract incidents were the most common, accounting for $228 million in losses across 71 incidents as the most exploited attack vector.
Of the $1.18 billion lost, about $387 million has been returned or reversed due to recovery, about 33 percent of the gross loss.
After the Liquid Network hack, self-proclaimed "white hats" recovered $272 million, representing about 85% of the stolen value.
In the Tectonic incident, Kronos' validations rolled back 114 minutes of the blockchain's settled date and reversed about $111.2 million of the $120.4 million in affected loans. Also, stablecoin issuers Circle and Tether froze about $340,000 related to the Bitgate heist.
Operators covered an additional $410 million in user losses from their own funds. Bitget's user protection fund covered $387 million, while Triple-A, Coinsbuy, and TAC refunded about $22 million and made users whole, while the stolen assets remained with the attackers.
About $384 million, or 32 percent of the gross loss, was neither returned nor covered.
The amount of damages covered by operators, compared to the amount returned or reversed. Source: Hacken
Hacken urged industry participants to strengthen the cybersecurity of third-party vendors, developer tools and other external infrastructure that may be outside of security audits.
The company also recommended that protocols expand security audits to include oracles, bridges, guard systems, signing authorities and other privileged components.