Q3 Crypto Breaches Near $1.2B Mark Following Bitget and Liquid Incidents
Security vulnerabilities in third-party suppliers, development infrastructure and tools beyond audit scope accounted for roughly 77% of quarterly losses, Hacken reports.
During the third quarter of 2026, digital asset security breaches climbed to $1.18 billion spanning 107 documented events, as reported by cybersecurity firm Hacken.
According to Hacken's third-quarter analysis, approximately 77% of the total losses (roughly $906 million) stemmed from vulnerabilities in third-party suppliers or development tools, publicly announced patches that remained unimplemented, or additional elements falling outside standard security assessments.
The quartet of most significant breaches encompassed the $387 million Bitget security incident, the $320 million Liquid Network compromise, the $120 million Tectonic exploitation, and the Coldcard firmware security flaw, which was linked to approximately $115 million in financial damages.
The third quarter of 2026 marked the most severe period for cryptocurrency security breaches since the first quarter of 2025, during which Bybit's massive $1.4 billion loss attributed to North Korea drove aggregate losses to $1.6 billion.
Approximately 80% of the financial damage sustained during the quarter was centralized within the four most significant incidents, whereas 98 of the documented breaches registered losses under $10 million. The middle value across the complete set of 107 incidents stood at $670,000.
Although third-party supplier breaches and infrastructure weaknesses accounted for the majority of stolen funds, vulnerabilities in smart contracts emerged as the most common attack method, responsible for $228 million in damages across 71 separate incidents, representing the most frequently exploited vulnerability category.
Approximately one-third of stolen funds were recovered or reversed following Q3 crypto hacks
From the total $1.18 billion in losses, approximately $387 million was either recovered or reversed through various means, representing roughly 33% of total gross losses.
After the Liquid Network security breach, individuals identifying themselves as "white hats" restored $272 million, which constituted approximately 85% of the funds that were initially stolen.
During the Tectonic breach, Cronos network validators executed a rollback of 114 minutes of confirmed blockchain transactions, effectively reversing approximately $111.2 million out of the $120.4 million in compromised lending positions. Additionally, stablecoin providers Circle and Tether implemented freezes on roughly $340,000 connected to the Bitget incident.
Platform operators compensated an extra $410 million in user losses using their own treasury reserves. Bitget's designated user protection fund absorbed $387 million in losses, while Triple-A, Coinsbuy and TAC collectively reimbursed approximately $22 million, fully compensating affected users, despite the stolen assets remaining under attacker control.
Roughly $384 million, representing 32% of total gross losses, was neither recovered nor reimbursed to victims.
Hacken called upon industry stakeholders to enhance cybersecurity measures for external suppliers, development tools and other third-party infrastructure elements that might exist beyond the scope of conventional security audits.
The security firm additionally advised that blockchain protocols broaden their security audit frameworks to encompass oracles, cross-chain bridges, custodial systems, signing authorization mechanisms and additional privileged infrastructure components.