Bitget and Liquid exploits push Q3 crypto hacks to $1.18 billion, says Hacken

Crypto hacks hit $1.18 billion across 107 recorded incidents in Q3 2026, according to Hacken. For high-risk payment and settlement teams, the useful detail is where the losses came from: most of the money was taken through compromised suppliers, developer tools, and other infrastructure that sits outside a standard security review.

1. Hacken said 77% of Q3 losses, or about $906 million, came from compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, or other components outside security reviews. In other words, the weak point was often not the core protocol itself, but the plumbing around it.
2. The four largest incidents were the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, which Hacken linked to an estimated $115 million in losses. About 80% of the quarter’s losses were concentrated in these four events, while 98 incidents lost less than $10 million each. The median loss was $670,000.
3. Smart contract incidents were the most frequent attack vector, with 71 incidents causing $228 million in losses. That is the familiar crypto pattern: the biggest dollar losses came from infrastructure and supplier failures, but the most common events still came from code-level failures.
4. About $387 million was returned or reversed after the quarter, equal to roughly 33% of gross losses. After the Liquid Network hack, self-proclaimed “white hats” returned $272 million, about 85% of the stolen value. In the Tectonic case, Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Circle and Tether also froze about $340,000 tied to the Bitget theft.
5. Operators covered another $410 million of user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million. About $384 million, or 32% of gross losses, was neither returned nor covered.

Hacken’s takeaway is straightforward: security reviews that stop at the core protocol miss a lot of the real attack surface. The company urged industry participants to harden third-party suppliers, developer tools and other external infrastructure, and to extend audits to oracles, bridgers, custody systems, signing authorities and other privileged components.