Bitget’s $387.5M hack pushed Q3 2026 crypto security losses to $1.26 billion

Crypto security incidents in Q3 2026 crossed $1.26 billion, with Bitget’s $387.5 million hack doing most of the heavy lifting. For PSPs, exchanges, and banking partners, the useful part is not the headline number alone: CertiK’s data shows how quickly one hot-wallet compromise can distort quarterly loss totals and why third-party security tooling is now part of the attack surface.

1. According to blockchain security company CertiK, losses from crypto security incidents reached $1.26 billion in Q3 2026, up 53.9% from $819.4 million in Q2. The number of incidents also rose about 13%, from 219 to 247.
2. Bitget’s hack accounted for about 31% of Q3 losses, making it the quarter’s largest recorded incident under CertiK’s methodology. The exchange said attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands.
3. Bitget detected unauthorized transfers from some of its hot wallets on Sept. 24 and suspended withdrawals. That sequence matters operationally: once hot-wallet movement is tied to compromised credentials, the control problem is no longer just custody, but access to the systems that authorize withdrawals.
4. The next-largest incident in Q3 was Liquid Network’s $319 million exploit on Sept. 6, followed by Tectonic at $120 million and the $112.7 million Coldcard theft.
5. For September alone, CertiK recorded roughly $769 million in losses across 99 security incidents. About $273 million was frozen or returned, leaving adjusted losses of $495.3 million. Across 58 incidents, exploits accounted for $734 million, or nearly 96% of the month’s losses.

For high-risk operators, the point is straightforward: wallet security, vendor security, and withdrawal controls now sit in the same failure chain. If a third-party product can be used to obtain internal credentials, the question for PSPs and exchanges is not just who signs the transaction, but who can reach the signing path in the first place.