Bitget, Liquid exploits push Q3 crypto hacks toward $1.2B

Cryptocurrency hacks soared to $1.18 billion across 107 recorded incidents in the third quarter of 2026, according to security company Hacken.

Hacken’s Q3 report attributed 77% (about $906 million) to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, or other components outside security reviews.

The four largest incidents included the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, associated with an estimated $115 million in losses.

This Q3 was the most damaging quarter for crypto hacks since Q1 2025, when Bybit’s $1.4 billion loss to North Korea pushed the total to $1.6 billion.

About 80% of the quarter’s losses were concentrated in four of the largest incidents, while 98 of the incidents recorded losses below $10 million. The median loss across all 107 incidents was $670,000.

While supplier compromises and infrastructure failures drove much of the stolen value, smart contract incidents were the most frequent, accounting for $228 million in losses across 71 incidents as the most exploited attack vector.

About a third of losses was returned or reversed after Q3 crypto hacks

Of the $1.18 billion lost, about $387 million was returned or reversed, accounting for the recovery of about 33% of gross losses.

Following the Liquid Network hack, self-proclaimed “white hats” returned $272 million, representing about 85% of the stolen value.

In the Tectonic incident, Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Also, stablecoin issuers Circle and Tether froze about $340,000 tied to the Bitget theft.

Operators covered an additional $410 million of user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million, making users whole, while stolen assets remained with attackers.

About $384 million, or 32% of gross losses, was neither returned nor covered.

Hacken urged industry participants to strengthen the cybersecurity of third-party suppliers, developer tools and other external infrastructure that may fall outside security audits.

The company also recommended that protocols expand security audits to include oracles, bridgers, custody systems, signing authorities and other privileged components.