Crypto hacks stole $1.18 billion across 107 incidents in the third quarter of 2026, security firm Hacken reported, making it the most damaging quarter for the industry since Q1 2025.

The losses cluster around four large exploits. Bitget's hack drained $387 million, the Liquid Network exploit took $320 million, Tectonic lost $120 million, and a Coldcard firmware vulnerability accounted for an estimated $115 million in losses. Those four incidents alone covered roughly 80% of the quarter's stolen value.

For context, the last worse quarter was Q1 2025, when Bybit's $1.4 billion breach — attributed to North Korea — pushed the total to $1.6 billion.

Where did the attacks actually come from?

Hacken's report puts 77% of quarterly losses, about $906 million, down to a specific failure mode: compromised suppliers, developer tools and infrastructure components that sit outside the scope of standard security audits. The report also cites publicly disclosed fixes that teams never deployed.

Smart contract exploits were the most frequent vector — 71 incidents producing $228 million in losses — but they were smaller on average than infrastructure compromises. The long tail is thin: 98 of the 107 incidents each lost under $10 million, and the median loss across all incidents was $670,000.

That distribution matters operationally. The industry's audit culture still centers on smart contract code, while the biggest checks are being written for failures in supply chains, key management and privileged infrastructure that audits rarely touch.

How much money came back?

Recovery and reimbursement ate into the gross figure, but not evenly.

• About $387 million, roughly 33% of gross losses, was returned or reversed after the hacks.
• Self-proclaimed "white hats" returned $272 million after the Liquid Network exploit, about 85% of the stolen value there.
• Cronos validators rolled back 114 minutes of settled blockchain history after the Tectonic incident, reversing about $111.2 million of the $120.4 million in affected borrowing.
• Circle and Tether froze roughly $340,000 of stablecoins tied to the Bitget theft.

Operators paid out another layer of protection. Bitget's user protection fund covered the full $387 million of its hack, and Triple-A, Coinsbuy and TAC together repaid about $22 million to make users whole — even though the stolen assets themselves stayed with the attackers.

The residual gap: roughly $384 million, or 32% of gross losses, was neither returned nor covered by operators.

What is Hacken telling the industry to fix?

The report's recommendations target the blind spot the numbers expose. Hacken urged companies to strengthen cybersecurity for third-party suppliers, developer tools and other external infrastructure that may fall outside security audits entirely.

It also recommended that protocols widen audit scope to cover oracles, bridgers, custody systems, signing authorities and other privileged components — the parts of the stack with the deepest permissions and, per this quarter's data, the largest losses attached to them.

The Cronos rollback raises a separate market-structure question: a 114-minute reversal of settled history is a governance intervention, not a technical fix, and it sets a precedent other chains will face pressure to justify — or refuse — the next time a nine-figure exploit lands on their ledger.