Crypto thefts climbed to $1.18 billion spread across 107 documented events during the third quarter of 2026, according to data from security firm Hacken.
The Q3 report released by Hacken blamed 77% of that total—roughly $906 million—on compromised developer tools or supply chains, unapplied public vulnerability fixes, and elements lying outside traditional security evaluations.
The four largest security breaches featured the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, which accounted for approximately $115 million in damages.
This particular third quarter marked the most destructive period for digital asset thefts since the first quarter of 2025, when Bybit lost $1.4 billion to North Korea, driving the aggregate loss figure to $1.6 billion.
Q3 losses in total amount and composition. Source: Hacken
Roughly 80% of all losses seen during the quarter came from just four massive incidents, while 98 separate occurrences involved sums under $10 million. Across all 107 recorded events, the median financial loss sat at $670,000.
Even though supply chain weaknesses and infrastructure failures drove the highest monetary volumes, smart contract flaws remained the most frequent attack vector, generating $228 million in damages over 71 individual events.
Related: Anthropic warns ‘AI worms’ may autonomously spread across devices like a virus
About a third of losses was returned or reversed after Q3 crypto hacks
Out of the $1.18 billion that was taken, about $387 million was successfully recovered or reversed, representing a recovery rate of roughly 33% of the gross losses.
In the wake of the Liquid Network breach, self-described ethical hackers sent back $272 million, which accounted for approximately 85% of what was taken.
During the Tectonic incident, validators on Cronos rolled back 114 minutes of confirmed blockchain transaction history, effectively reversing about $111.2 million out of the $120.4 million in impacted borrowings. Additionally, stablecoin issuers Tether and Circle froze around $340,000 linked directly to the Bitget theft.
Platform operators absorbed an additional $410 million of user damages utilizing internal reserves. The user protection fund managed by Bitget absorbed $387 million, while TAC, Coinsbuy, and Triple-A reimbursed about $22 million, making customers completely whole while the stolen funds remained with the hackers.
An estimated $384 million, equivalent to 32% of total gross losses, was neither recovered nor reimbursed.
Amount of losses covered by operators, compared to amount returned or reversed. Source: Hacken
Hacken strongly advised industry members to upgrade cybersecurity defenses surrounding third-party vendors, software developer utilities, and other external systems that frequently bypass standard security audits.
The security organization also suggested that protocols broaden their security reviews to encompass privileged elements including bridges, oracles, custody setups, and signing authorities.
Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer
Cointelegraph maintains a dedication to transparent and independent journalism. This reporting adheres to the official Cointelegraph Editorial Policy to deliver accurate and prompt details. Audience members are urged to independently verify all details.
Originally published at https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound.
