Crypto hacks in Q3 2026: $1.18 billion stolen, the worst quarter since Bybit, and the trackers disagree on the count

Crypto hacks in Q3 2026 cost about $1.18 billion across 107 incidents, according to Hacken’s quarterly security report, published on 15 October and relayed by Cointelegraph. That is about 55% more than the $764 million Hacken counted for the second quarter, and the auditing firm calls it the worst quarter since the first three months of 2025, when the Bybit theft alone took about $1.4 billion.

Four incidents did most of the damage. Bitget, the Liquid Network sidechain, the Tectonic lending market on Cronos and a firmware flaw in Coldcard hardware wallets account for about 80% of the quarter’s losses in Hacken’s count. The rest were mostly small: 98 of the 107 incidents stayed under $10 million, and the median loss was $670,000, according to Cointelegraph. Cointribune, which carried the report on 19 October, adds that Hacken only counts incidents of $250,000 or more.

Hacken is not the only firm keeping score, and the scores do not match. CertiK put the quarter at $1.26 billion across 247 incidents on 1 October. The public hacks database of DefiLlama, summed by Coindaro on 19 October, gives about $1.25 billion across 122 incidents. The dollar totals sit within $90 million of each other. The incident counts differ by a factor of more than two.

Hacken’s own figures could not be checked at the source: its website refused our requests on 19 October. Every Hacken number in this piece comes from the outlets that read the report, mainly Cointelegraph (15 October), Crypto Breaking News and Altcoin Buzz (16 October) and Cointribune (19 October), and is attributed to them.

Crypto hacks in Q3 2026: three trackers, three counts

Each tracker publishes its own total, with its own rules. Here is what they said about the third quarter, with the second quarter for scale.

Immunefi, another bug bounty and tracking firm, had not published a third-quarter figure that we could find. Its last count covered the first half of 2026: $972 million across 207 hacks, as reported by The Block on 9 July.

On the question of rank, the trackers point the same way. In DefiLlama’s data, summed by calendar quarter in UTC, no quarter since the first one of 2025 (about $1.61 billion) comes close to the third quarter of 2026; the next largest, the second quarter of 2026, holds about $818 million. CertiK’s $1.26 billion is 53.9% above its own second-quarter total. A year earlier, CertiK had counted $509 million for the third quarter of 2025, a quarter with no theft above $100 million.

Why the hack counts differ by more than 100 incidents

None of the reports we read explains the gap between 107 and 247 in detail, so what follows sets out the differences that are visible in the published rules and data, not a full reconciliation.

The first is the floor. Hacken’s database counts only incidents of at least $250,000, according to Cointribune. A tracker without that threshold picks up dozens of small drains, and each of them adds one to the count while barely moving the total. That fits the pattern in the table: counts far apart, dollar figures close, because four cases above $100 million dominate every total.

The second is gross against net. Tectonic is the clearest example. About $120 million was borrowed against inflated collateral on 30 August, but the Cronos validators reversed roughly $111.2 million of it with a chain rollback. Hacken lists Tectonic at about $120 million and DefiLlama at $124.5 million, both gross. A tracker that counted only what the attacker kept would have written about $9 million.

The third is dating. Bitget’s wallets were drained on 24 September, but SlowMist found malicious activity on one of the supplier’s appliances dating back to 31 August, according to BleepingComputer. Coldcard thefts began on 30 July according to TRM Labs, and on 31 July in DefiLlama’s records and Galaxy Research’s account. A tracker that dates incidents by disclosure and one that dates them by first theft can place the same money in different months, or in a different quarter at the edges.

The fourth is classification. DefiLlama sorts incidents by technique: in its records, Bitget is a hot wallet key compromise (Bitget itself says its private keys were not compromised and forged withdrawal commands were injected instead), Liquid an unbacked cross-chain mint, Tectonic a token accounting (donation) attack. Hacken sorts by root cause, asking why the defence failed. The same theft can land in very different boxes. By DefiLlama’s labels, key compromises took $591 million in the quarter across 18 incidents, bridge and cross-chain cases $343 million across 13, and token or share accounting flaws $194.8 million across 18.

Revisions add noise on top. The early Tectonic estimate was $75 million before the post-mortem put the borrowing at $120.4 million, and Hacken’s own first-quarter total moved from $464.5 million across 43 incidents to $482 million across 44. Scope matters most of all in quiet quarters. For the first quarter of 2026, Hacken counted $482 million, of which $306 million came from phishing and social engineering, including a single $282 million hardware wallet scam in January, according to Cointelegraph on 14 April. DefiLlama’s hacks database, which does not carry that scam, holds about $168 million across 52 incidents for the same three months.

Four incidents made about 80% of the losses

In Hacken’s ranking, as reported by Cointelegraph on 15 October and Crypto Breaking News on 16 October, the top four were Bitget at $387 million, Liquid Network at $320 million, Tectonic at $120 million and Coldcard at about $115 million. Each one failed in a different place.

Bitget: two security appliances from a supplier

Unauthorised transfers began leaving Bitget’s hot and warm wallets at 18:31 UTC on 24 September, according to the exchange’s incident page. The first estimate, reported by Bloomberg the next day, was $351.6 million. Bitget raised it to about $387.5 million after adding Zcash and TRON assets, and its incident page now gives about $388 million. Two separate investigations, by SlowMist and Google’s Mandiant, delivered on 30 September, found that the attackers gained privileged access to two third-party security appliances through zero-day flaws, planted a web shell on one of them, then moved to the server that ran the production wallet jobs and deployed malicious packages, according to BleepingComputer. The vendors have not been named.

Stablecoin issuers recovered little. Circle and Tether froze about $340,000, according to Cointelegraph. Counting other freezes, 24/7 Wall St. put the total at about $821,000 on 3 October, less than 0.25% of the loss. Bitget’s protection fund covered users. Chief executive Gracy Chen has blamed North Korean hackers; no law enforcement agency had confirmed that by mid-October. We covered the restart in our report on Bitget restoring all withdrawals after the $388 million hack.

Liquid Network: the peg-out flow, then a return

On 6 September, about 4,000 BTC, worth roughly $320 million, left the federation wallet of Liquid, the Blockstream sidechain, which held about 4,200 BTC. Liquid said the coins moved through the peg-out authorisation key of SideSwap, a federation member, and that the key itself was never compromised. A breakdown by Bitrue, cited by Security Affairs, points to a bug in Elements, Liquid’s open-source software, that let more L-BTC exist than the reserves backed, with the unbacked tokens then redeemed for real bitcoin. Blockstream patched the affected bridge nodes, but a full technical account was not among the sources we read.

Self-described white-hat hackers sent back 3,400 BTC, about 85% of the haul, on Monday 7 September, according to Decrypt and Security Affairs. Some 598.5 BTC, about $47 million, stayed at the attackers’ address. Ledger’s chief technology officer Charles Guillemet wrote that, if the return was a negotiated reward, it looked more like extortion than white-hat hacking. Liquid paused its bridge and asked exchanges to suspend L-BTC deposits and withdrawals.

Tectonic: a thin token used as collateral

On 30 August, an attacker pushed up the price of TONIC, Tectonic’s thinly traded governance token, used it as collateral in nine markets and borrowed $120.4 million. The last block before the Cronos halt was produced at 14:32 UTC, according to TRM Labs. Validators then rolled back 10,961 blocks, about 114 minutes of history, which reversed about $111.2 million, according to the Cronos post-mortem reported by The Block on 8 September. About $9.19 million escaped and has not been recovered. A rollback of this kind is rare and disputed, because it rewrites transactions that every other user had already treated as final.

Coldcard: seeds that were easier to guess

The Coldcard thefts began on 30 July, according to TRM Labs, which cites Galaxy Research’s tally of about 1,816 BTC, around $116 million, taken from more than 5,200 addresses. The cause goes back to firmware 4.0.1, released in March 2021: a build configuration error made some devices generate seeds from a weak software random number generator instead of the hardware entropy source, cutting the effective key strength from 128 bits to as little as 40 bits on older devices. Twenty-five minutes after the attack began, about 594 BTC from roughly 500 wallets had already been swept into one address, TRM Labs found.

Galaxy Research counted more than $115 million stolen from over 200 victims by at least 15 groups of attackers, and estimated that total damage could exceed $130 million. Coinkite’s own statements, as reported by Crypto.jobs, name the Mk3 model. A firmware update does not repair a wallet whose seed was created on the faulty firmware: those funds have to move to a new seed. The same family of flaw, weak seeds, drained Qubic wallets this week, as we reported on the chain halt after 1,404 Qubic wallets were emptied.

Most of the money left outside the audited code

Hacken’s main finding concerns where the defences failed. About $906 million, 77% of the quarter’s losses, came from compromised suppliers and developer tools, from fixes that had been disclosed but not deployed, and from components that sat outside the scope of the latest audit, according to Cointelegraph’s account of the report.

Cointribune gives the breakdown of that $906.8 million, which we attribute to its reading of Hacken’s report:

The three lines add up to the $906.8 million, which is 77% of $1.18 billion. By Cointribune’s own count, those three paths cover 11 incidents, about 10% of the 107. It presents Tectonic, where $120.4 million was borrowed under risk parameters that the audit did not cover, as about 70% of the out-of-scope line. Bitget’s theft, which investigators traced to a supplier’s security appliances, matches the description of the first line, though the incident list itself was not available to us.

Smart contracts, the code that audits do review, were the most frequent target: 71 incidents, but only about $228 million of losses, per Cointelegraph and Crypto Breaking News. Many small contract bugs, a handful of very large failures elsewhere. Recent examples on the contract and protocol side include the Pirate Chain minting bug and the NEAR Intents deposit flaw, both covered on Coindaro last week.

Phishing played a small part this quarter

Q3 2026 was not a phishing quarter. DefiLlama classifies only two incidents, worth about $2.6 million, as social engineering, among them a fake GIWA bridge site that took about $2.08 million on 27 September, plus about $0.5 million under front-end attacks. The contrast with the Bybit quarter is sharp: DefiLlama files the 2025 Bybit theft itself under social engineering, as signer phishing.

Hacken’s report, as covered, does not give a phishing figure for the third quarter. Its first-quarter report did: $306 million of $482 million came from phishing and social engineering, almost two thirds of that quarter’s total.

How much of the $1.18 billion came back

Hacken’s report, as relayed by Cointelegraph, puts about $387 million, or 33% of gross losses, as returned or reversed: the Liquid return and the Tectonic rollback carry most of it. Operators covered about $410 million from their own funds, Bitget’s $387 million protection fund first, with Triple-A, Coinsbuy and TAC adding about $22 million. About $384 million, 32%, was neither returned nor covered.

The three lines add up to the $1.18 billion total, so the report treats them as separate slices of gross losses. One figure repeats: $387 million appears both as the amount returned or reversed and as Bitget’s protection fund payout, as Crypto Breaking News’s account shows without reconciling the two. Liquid’s return (about $262 million to $272 million depending on the bitcoin price used) and Tectonic’s $111.2 million rollback make up most of the first line.

Q3 2026 against earlier quarters

Hacken’s quarterly series shows how fast losses climbed in 2026. The table uses Hacken’s figures where they were available to us and the Bybit quarter for reference.

The second quarter had already broken the calm of late 2025, with Drift (1 April) and Kelp (18 April): $285 million and $292 million in Hacken’s second-quarter report, $295 million and $293 million in DefiLlama’s records. The Kelp case is explained in our LayerZero project page. Hacken’s second-quarter report traced about 88% of that quarter’s $764 million to compromised keys, signers and infrastructure. A year earlier the picture was calm: CertiK counted $509 million for the third quarter of 2025, with no theft above $100 million, so its own third-quarter figure is about two and a half times higher in 2026.

Below the top four, the third quarter also had Nesa ($50 million, 24 August), the AFX bridge ($24.1 million, 22 July), Ostium ($23.8 million, 15 July), BonkDAO ($20 million, 6 July) and KITE Foundation ($13.3 million, 5 August, a key compromise), all in DefiLlama’s records. Cointelegraph’s September roundup adds Safe Wallet ($7.8 million), DCENT ($6 million) and Duelbits ($5.9 million).

What an audit covers, and what it does not

A smart contract audit is a review of a given version of the code, on a given date. It does not cover the security appliances an exchange buys from a vendor, the firmware inside a hardware wallet, a fix that the team has not yet shipped, or a risk setting changed after the review, such as which tokens a lending market accepts as collateral. Each of the four big cases of the quarter sat in one of those gaps.

Krish Gosai, of the firm Gosai Law, told Cointribune that an audit is “evidence, not a legal shelter” (our translation from French). Hacken’s advice to protocols and platforms, as reported by Cointelegraph, is to secure third-party suppliers, developer tools and external infrastructure, and to extend audits to oracles, bridges, custody and signing authorities. Cointribune adds a call to retest after every update, parameter change or alert, and Altcoin Buzz a call for standard frameworks to assess tools and suppliers.

What it means for European users under MiCA

In the European Union, the operational side of these failures falls under MiCA, which applies to crypto-asset service providers. On 8 July 2026, ESMA launched a common supervisory action on the digital operational resilience of these providers, with the focus on custody. National authorities, such as the AMF in France and Consob and the Bank of Italy in Italy, are reviewing a risk-based sample of licensed providers: governance, key and storage management, transaction controls, incident response, smart contract risks and reliance on third-party suppliers. The exercise runs from the second half of 2026 to the first half of 2027, and ESMA’s Board of Supervisors gets a final report in the second half of 2027.

None of the sources we read ties Bitget’s case to its EU status, and we do not draw that link here. For the rules themselves, our guide to the MiCA regulation sets out what a licensed provider must do with clients’ assets.

What holders can check after this quarter

These are practical suggestions drawn from the cases above, not Hacken’s list.

• Coldcard owners whose seed was generated between March 2021 and the patch should move funds to a newly generated seed, as TRM Labs advises; updating the firmware alone does not help.
• Owners of other hardware wallets can follow their vendor’s advisories and buy only from the maker; our seed phrase security guide covers how to create and store a new seed.
• On exchanges, a published protection fund, proof of reserves and a MiCA licence listed on ESMA’s register are things to check, and keeping only the balance you trade with limits the exposure.
• In DeFi, an audit report shows what was reviewed and when. It is worth checking whether it covers oracles, risk parameters and bridges, and whether a lending market accepts a thinly traded token as collateral, as Tectonic did.

What comes next

No dates are scheduled for the open questions. Bitget, Liquid and Coldcard follow-ups are pending: the Liquid flaw and its restart, the attribution of the attackers in all three cases (none of the sources we read names a state actor), the final number of Coldcard victims and the $9.19 million still missing from Tectonic. Immunefi and DefiLlama may publish full third-quarter write-ups, and Hacken’s own report page may become readable.

ESMA’s supervisory checks on custody and resilience run through the first half of 2027, with the final report due in the second half of that year. Hacken released its third-quarter report on 15 October, so its fourth-quarter edition can be expected around mid-January 2027, though the firm has not announced a date.