Crypto hacks hit $1.18 billion across 107 recorded incidents in the third quarter of 2026, according to a report from security firm Hacken. The quarter stands out as the most damaging period for crypto security since Q1 2025, when the Bybit incident attributed to North Korea contributed to total hack losses of $1.6 billion, as referenced by Hacken’s later summaries.

While the total figure is stark, Hacken also documented meaningful recoveries. Roughly $387 million of the $1.18 billion was returned or reversed after the attacks—about 33% of gross losses—highlighting both the scale of harm and how quickly parts of the industry can unwind damage when interventions happen.

Key takeaways

Q3 2026 losses reached $1.18 billion across 107 incidents, the worst quarter since Q1 2025.
Supplier and tooling weaknesses drove most stolen value: 77% (about $906 million) stemmed from compromised external components and similar gaps outside standard security reviews.
Smart contract exploits were the most frequent attack type, tied to $228 million losses across 71 incidents.
About a third of losses were recovered: $387 million was returned or reversed after Q3 hacks, while $384 million (32%) remained unrecovered.
Most incidents were smaller: 98 of 107 losses were under $10 million; the median loss was $670,000.

Big-number losses, with a concentrated set of incidents

Hacken’s Q3 assessment shows that the distribution of damage was uneven. Four incidents accounted for the majority of total losses, while the remaining cases were far smaller on average. Specifically, 80% of the quarter’s stolen value was concentrated in the top four events.

The largest incidents included:

$387 million tied to the Bitget hack
$320 million linked to the Liquid Network exploit
$120 million associated with the Tectonic exploit
$115 million estimated losses related to a Coldcard firmware vulnerability

At the other end of the scale, 98 of the 107 recorded incidents involved losses below $10 million. Hacken reported a median loss of $670,000, reinforcing that while the worst-case headlines dominate attention, many breaches involved lower—yet still significant—amounts.

Why Q3’s losses were driven by “outside the audit” risk

A central theme in Hacken’s findings is that much of the quarter’s value loss did not come from classic smart contract bugs alone. The report attributes 77% of Q3 stolen value—about $906 million—to issues such as compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, and other components that may sit outside security review boundaries.

That breakdown matters for investors, users, and protocol teams because it shifts attention from only code-level security to the broader development and operations ecosystem. If compromise or weakness originates in third-party tooling, dependency chains, privileged infrastructure, or external components, then even teams with strong internal practices may still be exposed.

Smart contract attacks were frequent, but not the only problem

Hacken also found that smart contract incidents were the most common category of exploit. In total, smart contract-related losses totaled $228 million across 71 incidents, making them the most exploited attack vector by count.

That said, frequency and impact do not necessarily line up. Hacken’s report indicates that major losses were often concentrated in specific high-impact incidents, many of which were influenced by factors outside direct contract execution—such as compromised external systems, infrastructure failure modes, or privileged operational components.

In other words, Q3’s data points to a hybrid threat landscape: smart contracts are still a top target, but the most damaging outcomes may depend on where the attacker can gain leverage beyond the application layer.

Recoveries after Q3 hacks: returned funds, reversals, and remaining gaps

Despite the scale of losses, Hacken reported notable recovery in the aftermath. From the $1.18 billion lost, about $387 million was either returned or reversed, corresponding to the recovery of around 33% of gross losses.

Several examples illustrate how recovery can happen through different mechanisms:

Liquid Network: After the hack, self-proclaimed “white hats” reportedly returned $272 million, which Hacken describes as about 85% of the stolen value. (Earlier coverage from Cointelegraph referenced the return of $270M.)
Tectonic: Hacken notes that Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of roughly $120.4 million in affected borrowing. It also cites stablecoin issuer actions, with Circle and Tether freezing about $340,000 tied to the Bitget theft.
Additional coverage by operators: Hacken reported that $410 million of user losses were covered using operators’ own funds. It specifically mentions Bitget’s user protection fund covering $387 million, plus repayments totaling about $22 million from Triple-A, Coinsbuy, and TAC.

Even with those interventions, not all losses were addressed. Hacken estimated that about $384 million, or 32% of gross losses, was neither returned nor covered—meaning the stolen assets remained with attackers.

What Hacken wants the industry to change next

Hacken’s recommendations focus on preventing the “external compromise” pattern highlighted in the quarter’s loss breakdown. The firm urged participants to strengthen cybersecurity around third-party suppliers, developer tools, and other external infrastructure that may not be fully examined by standard security audits.

It also recommended expanding audit scope for protocols to include privileged components that can be exploited even if core code is secure, including oracles, bridgers, custody systems, and signing authorities.

As Q3 2026 demonstrates, recoveries can reduce net damage, but they are not guaranteed—and the largest losses can still originate from weak links outside the contracts themselves. With 98 of 107 incidents under $10 million, the most pressing trend may be whether the industry can reduce systemic “outside-audit” exposure rather than just patch individual vulnerabilities after they’re exploited.

Investors and builders should watch whether protocols expand security review practices beyond their own codebases—especially around toolchains, dependencies, and operational privileges—and whether recovery mechanisms become more standardized as another high-loss quarter approaches.