Crypto Hacks in Q3 2026 Near $1.2B Losses Driven by Bitget and Liquid Exploits

Overview of Losses in Q3 2026

During the third quarter of 2026, cryptocurrency thefts totaled $1.18 billion across 107 reported incidents. Security firm Hacken highlighted that about 77% of these losses, roughly $906 million, were due to compromised suppliers, developer tool vulnerabilities, or other components that had publicly disclosed fixes not yet implemented. The most notable hacks involved Bitget with $387 million stolen, the Liquid Network exploit with $320 million lost, the Tectonic hack costing $120 million, and a Coldcard firmware vulnerability accounting for around $115 million in damages.

Approximately 80% of the total losses were concentrated in these four major incidents, while 98 out of 107 attacks resulted in losses under $10 million. The median loss per incident was estimated at $670,000. Smart contract exploitation was the most frequent attack vector, responsible for $228 million in losses across 71 instances.

Infrastructure failures and supply chain compromises significantly contributed to total losses. These external components often fall outside traditional security audits, heightening risk exposure across the ecosystem.

Fund Recovery and Compensation Efforts

Of the $1.18 billion lost in Q3, about $387 million (33%) was either recovered or reversed. Following the Liquid Network hack, self-described "white hat" hackers returned $272 million, representing approximately 85% of the stolen funds.

In the Tectonic exploit, validators on the Cronos blockchain rolled back 114 minutes of finalized blocks, reversing $111.2 million of the $120.4 million in affected loans. Additionally, stablecoin issuers Circle and Tether froze approximately $340,000 linked to the Bitget theft.

Beyond recovered assets, platform operators compensated users for an additional $410 million from their own funds. Bitget's user protection fund covered $387 million, and platforms like Triple-A, Coinsbuy, and TAC reimbursed about $22 million collectively, ensuring users were made whole despite stolen assets remaining with attackers.

An estimated $384 million, or 32% of gross losses, remained unrecovered and uncompensated by quarter’s end.

Security Recommendations Moving Forward

Hacken urges industry participants to prioritize cybersecurity enhancements focusing on third-party suppliers, developer tools, and external infrastructure that often lie outside the scope of security reviews.

The report advocates expanding audit coverage to include oracles, bridges, custody solutions, signing authorities, and other privileged components to mitigate overlooked vulnerabilities.

The Q3 findings emphasize the critical importance of rapid patch deployment and comprehensive audits to prevent exploitation of known vulnerabilities and substantial financial impact in the crypto space.