Broad Security Weaknesses Accounted for 77% of Q3 2026 Crypto Hack Losses

Crypto hacks and exploits caused $1.18 billion in gross losses across 107 incidents in Q3 2026, with weaknesses involving suppliers, developer tools, undeployed fixes and components outside security reviews accounting for $906 million.

That $906 million category combined compromised suppliers or developer tools, fixes that had been publicly disclosed but not deployed, and other components beyond security reviews. The group represented about 77% of the quarter’s gross total.

The four largest incidents — Bitget at $387 million, Liquid Network at $320 million, Tectonic at $120 million and a Coldcard firmware vulnerability associated with an estimated $115 million — together made up about 80% of the total. The median incident loss was $670,000, and 98 cases each involved less than $10 million.

Smart contract attacks were the most frequent type, with 71 incidents and $228 million in losses. The quarter’s $1.18 billion total was the highest for crypto hacks since Q1 2025, when losses reached $1.6 billion after a $1.4 billion Bybit breach.

About $387 million, or 33% of gross losses, was returned or reversed. In the Liquid Network incident, $272 million was returned, equal to about 85% of the stolen value. Circle and Tether froze about $340,000 connected to the Bitget theft.

Cronos validators reversed about $111.2 million of Tectonic’s $120.4 million in affected borrowing by undoing 114 minutes of chain activity. The $120 million Tectonic incident figure is rounded; the $120.4 million amount refers to affected borrowing.

Operators covered another $410 million in user losses. Bitget used its protection fund to cover $387 million in user losses; Triple-A, Coinsbuy and TAC paid roughly $22 million between them. Those listed amounts total about $409 million, close to the rounded overall coverage figure.

After recoveries and operator payments, roughly $384 million remained uncovered, equal to 32% of gross losses. The gross tally measures the value of assets involved when incidents occurred, so it differs from a final net-loss amount.

TokenPost’s earlier Q3 tally of affected assets put the figure at approximately $1.174 billion and did not establish a net-loss total. The newer breakdown separates returned or reversed funds from losses covered by operators.