Over $1.17 billion stolen in crypto hacks in Q3 2026, with September alone accounting for $762 million

Crypto companies lost more than $1.17 billion to cyberattacks in the third quarter of 2026, according to Finbold Research based on SlowMist incident data. For payment providers and other high-risk operators, the takeaway is blunt: the quarter was not just busy, it was concentrated, with a handful of incidents doing most of the damage.

1. Finbold Research calculated the Q3 2026 total using incidents tracked by SlowMist between July 1 and September 30, 2026. The figures reflect the gross value affected at the time of each incident, so they can differ from final unrecovered losses after funds are returned, frozen, or recovered.
2. September was the worst month of the quarter, with 50 known incidents affecting roughly $762 million worth of funds. August saw nearly 40 attacks and damage of nearly $188 million, while July recorded 35 incidents and more than $224 million in losses.
3. The five biggest crypto hacks in Q3 accounted for 81% of all losses, or $952 million combined. The largest was the September 24 Bitget hack, which alone accounted for $387.5 million.
4. The second-largest incident was the theft of $320 million worth of Bitcoin (BTC) from the Liquid Network. According to the report, a group of self-proclaimed “white-hat hackers” returned the majority of the funds within days.
5. The third-largest attack targeted Tectonic assets worth roughly $120 million, but the attackers were only able to evacuate less than $10 million before the chain was halted and rolled back. Other incidents in Q3 that left criminals empty-handed included the August Oraichain exploit, the Zeus infrastructure compromise in the same month, and the July Across signal spoofing attack.

The fourth-largest incident was the Coldcard hack, which affected $100 million worth of funds and involved breaching a hardware wallet, long treated as one of the safer storage options in crypto. The fifth-largest was the AFX Bridge exploit, which caused roughly $24.15 million in losses after validator signing keys were compromised.

For the year so far, Q3 pushed 2026 crypto hack losses to $2.1 billion, leaving them less than $700 million short of the $2.78 billion stolen in 2025. That is notable for one reason in particular: losses crossed the $2 billion mark without a single outlier on the scale of the $1.5 billion Bybit incident in Q1 2025.

There is also a timing problem in the numbers. Reporting delays can change totals long after a quarter ends, and Finbold notes that there had already been 11 known hacks in the first nine days of October, 2026 could still close with more damage on the board.