Bitcoin’s powerful third-quarter rally was accompanied by a sharp deterioration in crypto security, highlighting the gap between rising institutional interest and persistent weaknesses across the industry’s infrastructure. According to CoinDesk, crypto projects and users suffered 247 security incidents during the quarter, resulting in losses of $1.26 billion.
The figures, tracked by crypto security firm CertiK, show that attacks remain a major risk even as billions of dollars enter the market through exchange-traded funds linked to bitcoin and other digital assets. Bitcoin ended the third quarter 40% higher, outperforming every major asset despite Treasury yields reaching their highest level in more than two decades.
September becomes the year’s worst month
The security problem intensified toward the end of the quarter. September recorded 99 incidents, the highest monthly total since February 2025. Losses reached $768.5 million, making it the costliest month for crypto security incidents so far in 2026.
For the year to date, total losses stood at $2.68 billion. The quarterly figure therefore represented a substantial share of the damage recorded across the year, with September accounting for much of the third-quarter total.
CertiK said the September data demonstrated how quickly the threat environment can change. The company pointed to the simultaneous increase in both the number of incidents and the value lost, arguing that stronger security is needed across every layer of the crypto ecosystem.
The losses remain relatively small compared with the capital moving into crypto investment products. However, the effect on confidence may be more significant than the financial totals alone suggest. Nicolai Sondergaard, a senior research analyst at Nansen, told CoinDesk that repeated attacks can reinforce the perception that crypto infrastructure is operationally fragile.
That perception could affect how institutions approach the sector. It may contribute to additional attention from regulators and custodians, while investors allocating capital could demand compensation for what they view as higher operational risk.
Institutional money and a limited insurance cushion
The security concerns have not stopped institutional participation. Sondergaard said many institutions are gaining exposure through regulated and familiar structures, including exchange-traded funds, rather than directly using decentralized-finance protocols. That distinction helps explain why the recent attacks have not visibly derailed the broader market rally.
Still, the industry’s ability to absorb losses through insurance remains limited. CoinGecko’s State of Crypto Security Report 2026, released at the end of August, estimated on-chain crypto insurance capacity at $130.2 million. That was down 20.2% from $163 million a year earlier.
The available coverage is therefore small compared with the scale of the losses recorded by CertiK. The shrinking insurance capacity also means that protection has not expanded in line with the risks faced by crypto users and protocols, according to the security background cited by CoinDesk.
Insurance in this context is intended to help cover certain losses arising from events such as hacks or exploits, although coverage depends on the specific policy and incident. Its limited size does not eliminate the underlying technical risk, and it cannot by itself address weaknesses in the systems that are attacked.
Artificial intelligence creates a faster threat cycle
Artificial intelligence is adding another dimension to the security challenge. Oliver Carding, head of marketing at Tesseract Group, told CoinDesk that AI tools could automate the search for smart-contract vulnerabilities that previously required a skilled engineer months to identify.
Smart contracts are programs that execute transactions or other functions according to coded rules. If a weakness is found before developers can repair it, attackers may have a shorter window in which to exploit the flaw. Faster discovery by malicious actors could therefore increase pressure on project teams to detect and fix vulnerabilities quickly.
Security firm Blockaid expects incidents involving AI agents to emerge. It identified prompt injection as the most likely route. In a prompt-injection attack, hidden instructions manipulate an AI system into taking an action contrary to the user’s intentions.
The development matters because AI agents may increasingly interact with digital assets, software systems or transactions. If an agent can be tricked into following concealed instructions, the problem may extend beyond traditional smart-contract bugs to the way automated systems interpret and act on information.
Moneyiar market picture
Moneyiar market data at 9:09 a.m. local time on Oct. 3, 2026, showed Bitcoin at $84,637.78, down 1.74% over 24 hours but up 0.57% over seven days. Monad was priced at $0.03134, falling 7.74% in 24 hours while gaining 17.97% over the week.
Enjin Coin stood at $0.03372, up 3.27% over 24 hours and 6.22% over seven days. Billions Network was quoted at $0.01400, down 0.59% over 24 hours and up 10.04% over seven days; that reading was timestamped Sept. 21, 2026, rather than Oct. 3.
The latest security figures underline a central tension in the market: rising prices and institutional access are developing alongside technical vulnerabilities that can damage confidence. The third-quarter rally may have strengthened the market’s appeal, but the scale and frequency of attacks remain a serious obstacle for the industry’s credibility and broader adoption.
