Q3 2026 Crypto Hacks Hit $1.18B as Bitget, Liquid Lose $707M

Crypto hackers stole $1.18 billion across 107 incidents in the third quarter of 2026, according to a report from security firm Hacken, a 55% jump from the prior quarter and the worst three-month stretch for the industry since early 2025. Two breaches alone, a $387.5 million theft from exchange Bitget and a roughly $320 million exploit of the Liquid Network bitcoin sidechain, accounted for close to 60% of everything lost in the quarter.

What happened in Q3

Hacken's quarterly report, published October 15 and covered by Cointelegraph, found that cryptocurrency hacks and exploits caused $1.18 billion in gross losses across 107 incidents between July and September 2026. Four incidents made up about 80% of the total, while 98 of the 107 incidents each caused losses below $10 million; the median loss across all incidents was $670,000, Hacken said, indicating that a small number of large hits, not a broad wave of small thefts, drove the quarterly total.

The largest single incident was the September 24 attack on Bitget, in which the exchange said attackers stole $387.5 million from its hot and warm wallets, according to Bitget's own disclosure as reported by The Hacker News. Bitget later said the intruders exploited a zero-day flaw in a third-party security product to obtain internal credentials, which they used to issue fraudulent withdrawal commands that bypassed the exchange's risk controls. No private keys were stolen; the attackers spoofed the exchange's own authorization systems.

The second-largest incident hit the Liquid Network, a bitcoin sidechain operated by Blockstream and used by several exchanges to move funds. According to blockchain intelligence firm TRM Labs, attackers drained about $319 million in bitcoin from the network on September 6 by exploiting a bug that let them mint roughly 4,000 units of unbacked "Liquid Bitcoin" and convert them into real bitcoin. Self-described white-hat hackers later returned about 85% of the stolen funds, or $272 million, according to Hacken's recovery tally cited by Cointelegraph.

Why the quarterly total isn't the same everywhere

Readers comparing headlines on this story will notice the total losses figure differs depending on which security firm is cited, and the discrepancy is not a reporting error but a difference in methodology. Hacken put Q3 losses at $1.18 billion across 107 incidents. Separately, CertiK's dashboard counted 247 security incidents in the same quarter with total losses of about $1.26 billion, up 53.9% from $819.4 million in the second quarter, according to PANews's coverage of CertiK's data. PeckShield's tracker, cited by Logos Press, put the quarter's losses at $1.14 billion across 135 hacks, while SlowMist's figures, compiled by Finbold, showed more than $1.17 billion stolen. The trackers generally agree on the biggest incidents, Bitget's $387.5 million and Liquid Network's roughly $320 million consistently appear as the two largest, but they diverge on how many smaller incidents to count, what counts as a "hack" versus a protocol failure, and whether figures are adjusted for later recoveries. None of the four totals should be read as more "official" than another; each reflects a different firm's incident list and counting rules applied to the same three-month window.

What the 77% supply-chain figure actually means

Hacken's report attributed 77% of the quarter's losses, about $906 million, to compromised suppliers or developer tools, publicly disclosed fixes that had not yet been deployed, or other components that sat outside normal security reviews. That framing matters because it shifts the usual narrative around crypto hacks, which tends to focus on stolen private keys or smart-contract bugs inside audited code. In both of the quarter's largest incidents, the weak point was not the primary system an auditor would normally review. Bitget's breach ran through a zero-day in a third-party security product, and the Liquid Network bug sat in verification code that had not caught the specific flaw attackers found. Hacken's recommendation, per Cointelegraph's writeup, was that protocols extend security audits to cover oracles, bridges, custody systems and signing authorities, not just the application layer, since those surrounding components are now where a majority of dollar losses originate.

How much of the money came back

Of the $1.18 billion in gross Q3 losses Hacken tracked, about $387 million, or roughly a third, was returned or reversed. The Liquid Network recovery accounted for most of that, with the self-described white hats returning $272 million of the roughly $320 million taken. In a separate incident, the $120.4 million Tectonic exploit, Cronos validators rolled back 114 minutes of blockchain history, reversing about $111.2 million of the affected funds, while stablecoin issuers Circle and Tether froze a comparatively small $340,000 tied to the Bitget theft. Beyond the funds actually clawed back, exchange and protocol operators covered an additional $410 million of user losses from their own reserves, per Hacken's accounting. That still leaves roughly $383 million, about 32% of the quarter's gross losses, neither recovered on-chain nor covered by an operator, representing a real loss to the token holders or depositors affected.

How this quarter compares

Hacken's report, per Cointelegraph, described Q3 2026 as the most damaging quarter for crypto hacks since the first quarter of 2025, when the $1.4 billion theft from exchange Bybit pushed that quarter's total to $1.6 billion. By that comparison, Q3 2026's $1.18 billion is a meaningful quarter for losses but still below the peak set by the single Bybit incident in early 2025. What remains unverified from available reporting is whether any single actor or group was behind both the Bitget and Liquid Network incidents; researchers cited by Bleeping Computer attributed the Bitget breach to North Korea-linked hackers based on on-chain and IP-behavior patterns, but no comparable attribution has been confirmed for the Liquid Network exploit, where the attackers themselves claimed to be security researchers rather than thieves.