Q3 Crypto Hacks Hit $1.18B, 77% Outside Security Audits

Crypto hacks took $1.18 billion across 107 incidents in the third quarter of 2026, up 55% from the quarter before. The figure that tells you more sits underneath it: Hacken's new report traces about 77% of those losses, some $906 million, to compromised suppliers, developer tools, security fixes that were disclosed but never deployed, and other parts of the stack that sat outside an audit.

Those are the headline numbers in Hacken's Q3 2026 Security and Compliance Report, published on October 15. The quarter's two biggest losses, at Bitget and on the Liquid Network, show how differently that plays out in practice.

Bitget: A Zero-Day at the Edge

At Bitget, unauthorized transfers began at about 18:31 UTC on September 24 across several blockchains, from part of the exchange's hot and warm wallet infrastructure. Bitget's own account of the incident says attackers used a zero-day flaw in a third-party security product to reach internal management systems, take high-privilege credentials, and inject forged withdrawal commands into wallet back-end servers. Private-key compromise was ruled out, and cold wallets were untouched.

The final verified amount is about $388 million across 12 wallet addresses, Bitget says. CertiK put the same incident at $387.5 million. CEO Gracy Chen said the attacker “disguised their activity as routine administrative operations while removing traces of their actions.” Independent reports from Mandiant, part of Google Cloud, and SlowMist arrived on September 30 and broadly matched Bitget's account of the attack path.

Who was behind it is still open. Bitget has said it suspects the same group behind an earlier attack that week, without naming it pending a formal incident report. Chainalysis attributes the theft to North Korea-linked actors, which would push the total stolen by such actors in 2026 past $1 billion.

Liquid: 36 Minutes From Mint to Payout

Liquid Network, the Bitcoin sidechain run by Blockstream, moved faster. On September 6, an attacker exploited a caching flaw in the network's validation software: the bug let invalid transaction data point at a previously approved cached result and skip a full verification check.

At 13:53 UTC, in block 4,050,336, the attacker minted about 4,000 L-BTC with no backing. By 14:06 they had requested a withdrawal through SideSwap, an approved operator, and by 14:28 the federation had paid out about 4,000 BTC. Mint to payout took 36 minutes. Blockstream said none of its signing keys were compromised. Loss estimates land close together: TRM Labs puts it near $319 million, CertiK at $318.7 million.

The attacker then left a note. They embedded the words “we are whitehats. contact us on chain” in an OP_RETURN field of a Bitcoin transaction and negotiated with Blockstream through encrypted on-chain messages, promising to return funds once every node had patched the bug.

The Mix of Attacks Flipped

Hacken's breakdown shows how the quarter's losses were distributed. Smart contract exploits accounted for 48% of losses, up from 12% in Q2. Access control and operational failures fell to 40% from 88%. Hacken said the largest single-incident losses came from supply chain attacks, key compromises, and failures in signer and withdrawal infrastructure.

The recommendation that follows is blunt: harden third-party suppliers, developer tools and other external infrastructure, and widen audits to cover oracles, bridgers, custody systems and signing authorities. The point is that a protocol can sit inside a clean audit and still lose funds to a tool outside its scope.

What Came Back, and What Didn't

Not all of the $1.18 billion stayed lost. About $387 million was returned or reversed, roughly 33% of gross losses. After the Liquid hack, the self-described white hats returned about 3,400 BTC, some 85% of the haul, the day after the bug was patched, leaving close to 600 BTC worth about $47 million with the attackers, who appear to be claiming it as a bounty.

Operators covered another $410 million of user losses from their own funds: Bitget's protection fund absorbed $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million, making users whole. About $384 million, or 32% of gross losses, was neither returned nor covered.

At Bitget, the internal cleanup has run to schedule. The exchange replenished its Protection Fund above $300 million on September 30, ahead of its own deadline, and its latest update shows the fund holding 3,705 BTC. Its 47th Proof of Reserves update, from a September 29 snapshot, reported a 131% overall reserve ratio across 19 assets. The phased withdrawal-resumption plan finished on October 2.

The Wider 2026 Tally

Q3 is one quarter. TRM Labs' running count for 2026, through the Liquid attack, is about $1.73 billion across 333 incidents. The incident count is already a record; the dollars are running below 2025 and 2022, at an annualised pace of about $2.5 billion. Liquid is the largest attack recorded against a Bitcoin sidechain, ahead of April's $292 million KelpDAO theft and $285 million from Drift.