Crypto Hack Losses Near $1.2B in Q3 2026 After Bitget and Liquid Exploits
Bitget and Liquid hacks push quarterly thefts close to $1.2 billion
Cryptocurrency hacks reached nearly $1.18 billion in the third quarter of 2026, according to a report from security firm Hacken. The total came from 107 recorded incidents, making it the worst quarter for crypto thefts since the first quarter of 2025. The two largest incidents — the $387 million hack of exchange Bitget and the $320 million exploit of Liquid Network — accounted for the bulk of the losses. Four major incidents combined made up about 80% of the quarter's total stolen value.
Supplier compromises drove most losses
Hacken found that about 77% of the quarter's losses — roughly $906 million — came from compromised suppliers, developer tools, or infrastructure components that had not been covered by security audits. These included publicly disclosed fixes that platforms had not yet installed. Smart contract attacks were the most frequent type of breach, happening 71 times, but they caused $228 million in losses — less than the supply chain and infrastructure failures. Key points:
- Q3 2026 losses totaled $1.18 billion across 107 incidents.
- The Bitget hack ($387 million) and Liquid Network exploit ($320 million) were the two largest.
- About 77% of losses came from compromised suppliers or unaudited infrastructure.
- Smart contracts were the most attacked vector but caused less total loss.
- The median loss per incident was $670,000.
How much money was recovered?
Of the $1.18 billion lost, about $387 million was returned or reversed, recovering roughly a third of gross losses. After the Liquid Network hack, self-described "white hat" hackers returned $272 million, about 85% of what was stolen. In the Tectonic exploit on the Cronos network, validators rolled back 114 minutes of blockchain history, reversing about $111.2 million. Stablecoin issuers Circle and Tether also froze roughly $340,000 linked to the Bitget theft. Exchange operators covered an additional $410 million from their own funds. Bitget's user protection fund paid out $387 million, while Triple-A, Coinsbuy, and TAC repaid about $22 million. However, about $384 million — 32% of gross losses — was neither returned nor covered by operators.
What is still unclear
The report does not specify which suppliers or developer tools were compromised in each incident, nor does it identify the attackers behind the Bitget or Liquid Network breaches. The Coldcard firmware vulnerability, linked to an estimated $115 million in losses, involves a separate ongoing attack cycle.
Why supply chain security matters more than ever
Hacken urged crypto companies to strengthen cybersecurity around third-party suppliers, developer tools, and external infrastructure that often falls outside formal security audits. The firm also recommended that protocols expand their audit scope to include oracles, bridging systems, custody solutions, and signing authorities — components that handle privileged access but are frequently overlooked.
How this quarter compares
The previous record for quarterly crypto hack losses was set in Q1 2025, when Bybit lost $1.4 billion in an attack linked to North Korean hackers, pushing that quarter's total to $1.6 billion. Q3 2026 is now the second-worst quarter on record.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.