Crypto's Q3 Heist Tally Hits $1.18B — Turns Out "White Hat" Refunds Still Can't Beat the Whiteboard

Cryptocurrency hacks reached $1.18 billion across 107 recorded incidents in the third quarter of 2026, according to security firm Hacken. Hacken's Q3 report attributed 77% of that total — roughly $906 million — to compromised suppliers, developer tools, publicly disclosed fixes that had not been deployed, or other components outside formal security reviews. The quarter marked the worst for crypto hacks since Q1 2025, when Bybit's $1.4 billion loss attributed to North Korea pushed the period's total to $1.6 billion.

Four incidents dominated the damage. The $387 million Bitget hack led the list, followed by the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, which was tied to an estimated $115 million in losses. About 80% of the quarter's losses were concentrated in those four events, while 98 of the 107 incidents involved losses below $10 million. The median loss across all recorded incidents was $670,000. Although supplier compromises and infrastructure failures drove much of the stolen value, smart contract incidents were the most frequent attack vector, accounting for $228 million in losses across 71 cases.

Recovery efforts clawed back a notable share. Of the $1.18 billion lost, roughly $387 million — about 33% — was returned or reversed. After the Liquid Network hack, self-proclaimed "white hats" returned $272 million, representing approximately 85% of the stolen value. In the Tectonic incident, Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Stablecoin issuers Circle and Tether also froze roughly $340,000 tied to the Bitget theft.

Operators covered an additional $410 million of user losses from their own funds. Bitget's user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million combined, making users whole even though the stolen assets remained with attackers. About $384 million, or 32% of gross losses, was neither returned nor covered.

Hacken urged industry participants to strengthen cybersecurity at third-party suppliers, developer tools and other external infrastructure that may fall outside security audits. The firm also recommended that protocols expand audits to include oracles, bridge components, custody systems, signing infrastructure and other privileged components.