# Broad Security Weaknesses Accounted for 77% of Q3 2026 Crypto Hack Losses By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/32453 Published: 2026-10-15T11:06:50.000Z Updated: 2026-10-15T11:06:50.000Z Section: Technology > Crypto hacks caused $1.18 billion in gross losses across 107 incidents. Four cases, led by Bitget and Liquid Network, made up about 80% of the total. Crypto hacks and exploits caused $1.18 billion in gross losses across 107 incidents in Q3 2026, with weaknesses involving suppliers, developer tools, undeployed fixes and components outside security reviews accounting for $906 million. That $906 million category combined compromised suppliers or developer tools, fixes that had been publicly disclosed but not deployed, and other components beyond security reviews. The group represented about 77% of the quarter’s gross total. The four largest incidents — Bitget at $387 million, Liquid Network at $320 million, Tectonic at $120 million and a Coldcard firmware vulnerability associated with an estimated $115 million — together made up about 80% of the total. The median incident loss was $670,000, and 98 cases each involved less than $10 million. Smart contract attacks were the most frequent type, with 71 incidents and $228 million in losses. The quarter’s $1.18 billion total was the highest for crypto hacks since Q1 2025, when losses reached $1.6 billion after a $1.4 billion Bybit breach. About $387 million, or 33% of gross losses, was returned or reversed. In the Liquid Network incident, $272 million was returned, equal to about 85% of the stolen value. Circle and Tether froze about $340,000 connected to the Bitget theft. Cronos validators reversed about $111.2 million of Tectonic’s $120.4 million in affected borrowing by undoing 114 minutes of chain activity. The $120 million Tectonic incident figure is rounded; the $120.4 million amount refers to affected borrowing. Operators covered another $410 million in user losses. Bitget used its protection fund to cover $387 million in user losses; Triple-A, Coinsbuy and TAC paid roughly $22 million between them. Those listed amounts total about $409 million, close to the rounded overall coverage figure. After recoveries and operator payments, roughly $384 million remained uncovered, equal to 32% of gross losses. The gross tally measures the value of assets involved when incidents occurred, so it differs from a final net-loss amount. [TokenPost’s earlier Q3 tally of affected assets]() put the figure at approximately $1.174 billion and did not establish a net-loss total. The newer breakdown separates returned or reversed funds from losses covered by operators. ## Links in this article - [TokenPost’s earlier Q3 tally of affected assets](https://www.tokenpost.com/news/technology/28872)