Cybersecurity firm Hacken recorded 107 security incidents in the cryptocurrency sector during the third quarter of 2026, with total losses reaching $1.18 billion.
According to the report, approximately 77% of losses, or $906 million, originated from compromised suppliers, developer tools, unimplemented security patches, and infrastructure components outside the scope of standard smart contract audits. The four largest incidents accounted for roughly 80% of total losses.
The most costly events included the Bitget attack at $387 million, the Liquid Network incident at $320 million, the Tectonic attack at around $120 million, and the Coldcard firmware vulnerability at approximately $115 million.
Smart contract attacks were the most frequent incident type by volume, with 71 cases causing about $228 million in losses. Of the 107 recorded incidents, 98 resulted in losses below $10 million, with a median loss of $670,000.
Roughly $387 million was later recovered or reversed. In the Liquid Network case, individuals identifying as white-hat traders returned $272 million. In the Tectonic case, about $111.2 million in transactions were reversed when Cronos validators retrieved blockchain history. Platform operators also covered $410 million of user losses from their own resources. Despite this, approximately $384 million remains unrecovered or uncompensated.
