According to Hacken, in the third quarter of 2026, cryptocurrency hacker attacks caused a total loss of $1.18 billion in 107 recorded incidents.
In its quarterly report, this security company stated that approximately 77% (about $906 million) of the losses were due to breaches in suppliers' or development tools, publicly disclosed but not yet deployed patches, or other components that were not included in the security review.
The four incidents with the greatest losses include: Bitget suffering a hacker attack resulting in a loss of $387 million, Liquid Network vulnerability exploitation causing a loss of $320 million, Tectonic vulnerability exploitation resulting in a loss of $120 million, and Coldcard firmware vulnerability, with related losses estimated at $115 million.
According to Hacken, this quarter has seen the most severe losses due to crypto hacker attacks since the first quarter of 2025. At that time, Bybit suffered a loss of $1.4 billion from attacks by North Korea, bringing the total losses to $1.6 billion.
In the total losses and composition for that quarter, approximately 80% of the losses were concentrated in four of the largest incidents, while 98 out of 107 incidents had losses below 10 million US dollars. The median loss for all incidents was 670,000 US dollars.
Although supply chain breaches and infrastructure failures contributed to the majority of the stolen value, smart contract incidents were the most common attack vectors, with a total of 71 incidents resulting in losses of $228 million.
About one-third of the losses incurred by crypto hackers in the third quarter were recovered or reversed.
Of the $1.18 billion in losses, approximately $387 million was recovered or reversed, which is equivalent to about 33% of the total losses.
After the Liquid Network hacking incident, individuals claiming to be "white hats" returned $272 million, which is approximately 85% of the stolen value.
In the Tectonic incident, the verifier Cronos rolled back 114 minutes of settled blockchain history, reversing approximately $111.2 million, which corresponds to the majority of the $120.4 million in affected loans. At the same time, the stablecoin issuers Circle and Tether froze about $340,000 related to the theft incident involving Bitget.
The operator also used its own funds to cover an additional $410 million in user losses. The user protection fund of Bitget covered $387 million, while Triple-A, Coinsbuy, and TAC compensated a total of about $22 million, making up for the users' losses; however, the stolen assets remain in the hands of the attackers.
Approximately $384 million, which is 32% of the total loss, has neither been recovered nor compensated for.
Hacken urges industry participants to strengthen the cybersecurity of third-party suppliers, development tools, and other external infrastructures that may not be within the scope of security audits.
