Crypto hacks near $1.2B in Q3 as Bitget and Liquid dominate losses

Cryptocurrency security firm Hacken says hacks and related incidents cost the industry about $1.18 billion across 107 cases in the third quarter of 2026 — the worst quarter since Q1 2025, when the Bybit theft helped push totals to $1.6 billion.

Where the money went

Cointelegraph summarised Hacken's Q3 report as follows:

• About 77% of losses (~$906 million) were tied to compromised suppliers or developer tools, disclosed-but-undeployed fixes, or other components outside security reviews.
• The four largest cases: Bitget ($387 million), Liquid Network ($320 million), Tectonic ($120 million), and a Coldcard firmware issue linked to roughly $115 million in losses.
• Those four made up about 80% of the quarter's dollar losses; 98 incidents were under $10 million each. Median loss: $670,000.
• Smart-contract exploits were the most frequent vector — 71 incidents and $228 million — but supplier and infrastructure failures drove more of the total value.

Recoveries and who paid users

Of the $1.18 billion gross:

• About $387 million (~33%) was returned or reversed — including $272 million recovered after Liquid (about 85% of that theft) and a 114-minute Cronos rollback that undid roughly $111.2 million of Tectonic's $120.4 million impact. Circle and Tether froze about $340,000 tied to Bitget.
• Operators covered another ~$410 million from their own funds (Bitget's user protection fund $387 million; Triple-A, Coinsbuy and TAC about $22 million combined).
• Roughly $384 million (32%) was neither returned nor covered.

What Hacken recommends

Hacken urged teams to harden third-party suppliers, developer tooling and external infrastructure that often sit outside audits — and to extend reviews to oracles, bridges, custody systems and signing authorities.

Hardware custody does not eliminate every risk: supply-chain implants and firmware issues still appear in quarterly tallies. Our explainer What is a hardware wallet? covers how cold storage helps — and where it does not.