Hackers inflicted about $1.18 billion in losses on digital asset projects and platforms in the third quarter of 2026, a 55% quarter-over-quarter increase, according to a quarterly report by blockchain security firm Hacken. Nearly four-fifths of the losses were linked to attack vectors falling outside the scope of the most recent security reviews.
The results raise questions about the degree of protection investors and users can expect from an “audited” label. Losses were also concentrated in a handful of major incidents, indicating that the most severe risks lie in systems with access to and authority to move assets.
A handful of incidents drove most Q3 losses
Hacken recorded 107 incidents in Q3, but the majority of losses were concentrated in a small number of attacks. Four incidents exceeding $100 million resulted in a combined loss of $941.5 million, accounting for nearly 80% of the quarter’s total. The median loss across all incidents was just $670,000, showing that the overall increase was driven primarily by exceptionally large security events.
Bitget suffered the largest attack on Sept. 24, with $387.5 million stolen according to Hacken’s metrics. According to Bitget’s investigation update, the attacker exploited a vulnerability in a third-party security product to steal internal credentials and forge withdrawal requests. Bitget stated that its private keys and cold wallets were not compromised.
Liquid Network ranked second, with approximately $319 million affected on Sept. 6. A bug in the rangeproof verification cache of the Elements software allowed the attacker to mint nearly 4,000 unbacked L-BTC, which were then exchanged for real BTC via the peg-out process.
Tectonic, a lending protocol on Cronos, recorded $120.4 million in borrowed value stemming from price-manipulated collateral. This figure represents the value impacted before the blockchain was rolled back, not the final loss. The Coldcard incident was estimated by Hacken at around $115 million, involving a firmware bug that reduced the entropy of certain Bitcoin seeds.
Top 10 largest loss incidents in Q3 2026. Source: Hacken
Most losses fell outside the latest security reviews
According to Hacken, $906.8 million or 77% of the quarter’s losses were linked to vendor software, public code fixes published before vulnerabilities were fully addressed, or components falling outside the scope of the most recent security review.
Vendors and development tools accounted for $411.5 million. Bitget alone contributed $387.5 million to this figure. The remainder came from AFX Trade, a bridge that lost $24 million after malware from a Git repository infected its development environment, allowing attackers to compromise five out of seven validators.
Hacken categorized four incidents accounting for $324.8 million in losses into the group where fixes were publicly disclosed prior to the attack. At Liquid Network, a public fix on Sept. 1 left a bug in how cache keys were generated, according to Blockstream’s technical assessment. The remaining vulnerability was exploited on Sept. 6, before a complete patch was released.
Approximately $170.5 million came from components not included in the most recent review. Tectonic had undergone four audits, but those reports did not determine whether TONIC collateral parameters were safe under real-world liquidity conditions.
“The issue is always scope,” Hacken co-founder Andrii Matiukhin told CoinDesk. According to him, an audit badge does not automatically cover wallets, transaction-signing systems, third-party software, or changes deployed after the review.
Operators covered $410 million in user losses
Approximately $387 million or 33% of the quarter’s losses was recovered or reversed. Operators spent an additional $410 million of their own funds to compensate users, while $384 million remains unrecovered or unpaid, according to Hacken.
At Liquid Network, the attacker claimed to be a white hat and returned 3,400 BTC, worth approximately $272 million at the time. Blockstream stated that around 602 BTC has not been recovered.
Cronos validators also rolled back 10,961 blocks following the Tectonic incident, reversing approximately $111.2 million out of the $120.4 million affected. About $9.19 million left the network before the blockchain was halted and was not recovered.
Bitget utilized its User Protection Fund to cover $387.5 million for users. Triple-A, Coinsbuy, and TAC compensated a combined total of around $22 million. Hacken classified these payments as operator coverage because user balances were protected, even though the stolen assets were not recovered.
Other estimates put Q3 losses higher
CertiK recorded approximately $1.28 billion in losses across 268 incidents in Q3, higher than Hacken’s $1.18 billion across 107 incidents. After deducting frozen or returned assets, CertiK’s adjusted loss stood at around $877.8 million.
The disparity stems from tracking scopes and incident classification methodologies. Security firms apply different criteria for phishing, scams, wallet compromises, and technical exploits. Loss thresholds, asset valuation timing, and accounting of returned funds can also alter the figures.
Despite methodological differences, both datasets place Bitget and Liquid Network among the quarter’s costliest security incidents.
