Cryptocurrency thefts and exploits caused $1.18 billion in losses across 107 incidents during the third quarter of 2026, making it the most damaging quarter for crypto hacks since the first quarter of 2025, according to security firm Hacken and reporting by Cointelegraph.
External infrastructure accounted for most losses
Around 77% of the quarter’s losses, or approximately $906 million, was linked to compromised suppliers, developer tools, infrastructure components outside security reviews, and fixes that had been disclosed but not implemented. The figures highlight how attacks can enter crypto systems through supporting technology rather than directly through a protocol’s core code.
The four largest incidents accounted for about 80% of all losses. They included the $387 million Bitget hack, the $320 million exploit involving Liquid Network, the $120 million Tectonic exploit and a Coldcard firmware vulnerability associated with an estimated $115 million in losses.
The quarter’s median loss was $670,000. Although a small number of major incidents dominated the total, 98 of the 107 recorded events resulted in losses of less than $10 million.
Smart-contract attacks were the most common type of incident, generating $228 million in losses across 71 cases. Hacken said the quarter was the worst for crypto hacks since the first quarter of 2025, when a $1.4 billion loss at Bybit, attributed to North Korea in the source material, helped push quarterly losses to $1.6 billion.
A third of losses was recovered or covered
Of the $1.18 billion lost during the quarter, about $387 million was returned, reversed or covered, equal to roughly 33% of gross losses. That left approximately $384 million, or 32% of the total, neither returned nor covered.
After the Liquid Network incident, individuals describing themselves as “white hats” returned $272 million, or about 85% of the stolen amount. In the Tectonic case, Cronos validators rolled back 114 minutes of settled blockchain history, reversing roughly $111.2 million of the $120.4 million in affected borrowing.
Circle and Tether froze approximately $340,000 connected to the Bitget theft. Operators also absorbed $410 million in user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million. These payments made users whole even though attackers retained the stolen assets in those cases.
Hacken calls for wider security checks
Hacken recommended that crypto projects strengthen oversight of third-party suppliers, development tools and external infrastructure that may not be included in standard audits. It also called for broader reviews covering oracles, bridges, custody systems, signing authorities and other components with privileged access.
The recommendations matter because the quarter’s losses were concentrated in systems and services supporting crypto networks, while smart-contract vulnerabilities remained the most frequent attack route. Together, the figures show both the scale of individual failures and the range of security dependencies involved in digital-asset infrastructure.
Moneyiar market picture
Moneyiar data at 21:14 on October 15, 2026, showed Plasma (XPL) at $0.0859380477, up 7.49% over 24 hours and 2.16% over seven days. Compound (COMP) was $22.4050016957, down 0.56% in 24 hours and 3.75% over seven days. ORDI traded at $3.9551046044, down 0.53% and 5.18%, respectively. Velo (VELO) was $0.0044369377, up 0.75% in 24 hours but down 10.93% over seven days.
