Security firm Hacken reports that cryptocurrency theft reached $1.18 billion during the third quarter of 2026, spread across 107 separate incidents. The firm's quarterly analysis shows that roughly $906 million — 77% of the total — stemmed from weaknesses in third-party suppliers, development tooling and infrastructure elements that fell outside the scope of standard security reviews.
Four attacks accounted for the bulk of the damage. Bitget lost $387 million, Liquid Network suffered a $320 million exploit, the Tectonic platform on Cronos saw $120 million drained, and a firmware flaw in Coldcard hardware wallets was linked to an estimated $115 million in theft.
The quarter ranks as the worst for crypto security since the opening three months of 2025, when a $1.4 billion breach at Bybit — attributed to North Korean actors — drove industry-wide losses to $1.6 billion.
Four incidents captured roughly 80% of the stolen value, while the remaining 98 cases each involved losses under $10 million. The median theft across all 107 events stood at $670,000.
Smart contract flaws remained the most common entry point for attackers, responsible for 71 incidents that collectively cost $228 million, even though supplier and infrastructure breaches accounted for larger individual sums.
Recovery and reimbursement reduced net losses by two thirds
Approximately $387 million of the stolen funds was either recovered or nullified, representing 33% of gross losses. Actors describing themselves as white-hat security researchers returned $272 million following the Liquid Network incident, covering roughly 85% of what was taken.
After the Tectonic exploit, Cronos network validators executed a 114-minute rollback of confirmed transactions, unwinding $111.2 million of the $120.4 million in compromised loans. Separately, Circle and Tether froze $340,000 connected to the Bitget breach.
Platform operators absorbed a further $410 million in user losses using their own reserves. Bitget's protection fund covered the full $387 million stolen from its users. Three smaller services — Triple-A, Coinsbuy and TAC — reimbursed customers for combined losses of about $22 million, though the stolen assets remained in attacker wallets.
That left $384 million, or 32% of the total, unrecovered and uncompensated.
Hacken called on the industry to extend cybersecurity measures beyond protocol code to encompass third-party vendors, development dependencies and external infrastructure that typically escape audit coverage. The firm also advised protocols to bring oracles, cross-chain bridges, custody arrangements, signing authorities and other privileged system components within the perimeter of formal security assessments.
Source: cointelegraph.com