iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Crypto losses surged toward $1.2 billion in the third quarter of 2026, with a few exceptionally large attacks accounting for most of the damage. Bitget and Liquid Network alone represented more than half of the quarter’s losses, exposing weaknesses in exchange credentials, signing systems, third-party security software and smart-contract infrastructure.
How much was stolen in Q3 2026?
Hacken counted $1.18 billion stolen across 107 incidents during Q3 2026, a 55% increase from Q2. Hacken described the quarter as “one of the costliest quarters on record for digital asset security.”
A separate CD Security dataset counted $1.24 billion in technical losses across 146 incidents. These totals are not necessarily contradictory: the companies used different incident lists, classifications and measurement methods. The $1.18 billion figure is Hacken’s primary total for stolen funds, while CD Security’s number covers a broader set of technical incidents.
Losses were highly concentrated. A contemporaneous incident summary estimated that approximately 80% of the quarter’s damage came from four events:
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Incident | Estimated or confirmed amount | Primary attack surface | Response or recovery reported |
|---|---|---|---|
| Bitget, September 24 | About $387.5 million transferred; later rounded by Bitget to about $388 million | Third-party security product, privileged credentials and withdrawal infrastructure | Incident contained; vulnerability remediated; Protection Fund replenished above $300 million |
| Liquid Network | About $320 million | Signer and network infrastructure | About $272 million returned by self-described white hats |
| Tectonic | About $120 million | Not stated in the incident summary | Not stated in the incident summary |
| Coldcard firmware vulnerability | Estimated $115 million | Firmware and key-management infrastructure | Not stated in the incident summary |
The remaining 103 incidents were much smaller by comparison: 98 of the 107 incidents were below $10 million, and the median loss was $670,000.
What happened in the Bitget hack?
Unauthorized transfers from wallet infrastructure
Bitget said unauthorized transfers began at approximately 18:31 UTC on September 24, 2026. The affected systems were part of the exchange’s hot- and warm-wallet infrastructure. Bitget’s investigation confirmed approximately $387.5 million transferred to attacker-controlled addresses. The assets were spread across Ethereum and other EVM networks, XRP Ledger, Zcash and TRON.
How the attackers bypassed controls
According to Bitget’s official investigation, attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials. They then issued fraudulent withdrawal commands that bypassed existing risk controls. This was not a case of a user account simply being drained through a stolen password; the reported path reached privileged operational systems that could authorize withdrawals.
Recommended Free Tools
Bitget said the attack path was identified, the underlying vulnerability was remediated and the incident was contained. Its later protection-fund notice described the final affected amount as approximately $388 million and said user account balances remained accurate and unaffected.
Was Bitget’s user fund affected?
Bitget designated its Protection Fund to cover the incident’s financial impact. The exchange said the fund had been replenished to more than $300 million by September 30, 2026. That statement concerns Bitget’s reported coverage of the affected amount; it does not mean the stolen assets were recovered from the attackers.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What happened to Liquid Network?
The Liquid Network incident was estimated at about $320 million, making it the second-largest named event in the quarter. The incident summary reports that self-described white hats returned approximately $272 million, or about 85% of the stolen value. That recovery represented most of the quarter’s returned funds.
The available accounting describes returned or reversed assets, not necessarily a permanent reversal of every transaction on the underlying networks. The distinction matters because blockchain transfers can be frozen, negotiated back, or covered by an operator without the original attacker transaction being technically undone.
Why did crypto hacks reach $1.2 billion?
Smart-contract exploits remained the largest category
Hacken assigned 48% of Q3 losses to smart-contract exploits. Contract logic, upgrade mechanisms, bridges and oracle-dependent applications can still create direct paths to large-scale fund loss when an exploitable condition is deployed on-chain.
Operational and access failures were nearly as important
Hacken assigned another 40% to access-control and operational failures. That category includes compromised credentials, signer problems, withdrawal systems and deployment processes. The Bitget incident illustrates why a secure contract cannot compensate for a compromised privileged workflow: the reported entry point was a third-party security product and the damaging action was an unauthorized withdrawal command.
Supply chains expand the attack surface
Hacken identified supply-chain attacks, key compromises and failures in signer and withdrawal infrastructure among the largest single-incident drivers. Exchanges, custodians and decentralized applications depend on security software, developer tooling, firmware, cloud services, bridges and key-management systems. Each dependency can provide an attacker with a route around otherwise well-audited application code.
Rank #3
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Were the stolen funds recovered?
The incident summary says approximately $387 million, or about 33% of gross Q3 losses, was returned or reversed. Liquid accounted for roughly $272 million of that amount.
The same summary says operators covered about $410 million of user losses from their own funds, including Bitget’s Protection Fund coverage. It also reports approximately $384 million, or 32% of gross losses, neither returned nor covered.
These figures describe different accounting categories and can overlap: a returned asset, a transaction reversal and an operator reimbursement are not the same event. They should not be added together as if they were mutually exclusive portions of one pie.
What the quarter’s concentration means for risk
The headline total is driven by outliers. Four incidents produced about four-fifths of Hacken’s counted losses, while the median incident was $670,000. That distribution has two implications:
- A single failure in a signing or withdrawal system can outweigh dozens of smaller application bugs.
- Lower-value incidents remain frequent even when the quarterly total is dominated by a few spectacular events.
CD Security’s broader count reached $1.24 billion, with Bitget, Liquid Network and Tectonic representing about 67% of that dataset’s total. The concentration pattern therefore persists even when the incident universe changes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Are smart contracts still the main crypto-hack risk?
They are the largest single category in Hacken’s breakdown, but not an isolated majority of the risk. Smart-contract exploits accounted for 48%, while access-control and operational failures accounted for 40%. A security program focused only on contract audits would therefore leave most of the other major attack paths outside its review.
Organizations handling digital assets should assess the complete transaction path:
- Contracts and upgrade controls: review business logic, privileged roles, upgradeability and emergency procedures.
- Keys and signing authorities: enforce least privilege, hardware-backed key management, separated duties and independent approval.
- Withdrawal infrastructure: validate destination addresses and transaction intent independently, with limits and rapid disable controls.
- Third-party dependencies: inventory security products, cloud services, developer tools, firmware and libraries that can reach production credentials.
- Monitoring and response: detect unusual signer activity and withdrawal patterns, rehearse containment and maintain a tested communications plan.
- Disclosure incentives: operate a meaningful bug-bounty process and review contract upgrades and deployment changes before release.
What users should take from the Bitget incident
Bitget’s statement that account balances remained accurate and unaffected is specific to the exchange’s reported response. It does not establish that every exchange or wallet using similar infrastructure has the same protection. Users assessing a platform should look for clearly documented custody arrangements, withdrawal safeguards, incident disclosures and the scope of any reimbursement fund.
For the industry, the quarter’s evidence points to defense in depth: audited code, protected signing keys, segregated privileges, supplier review, continuous monitoring and the ability to halt withdrawals quickly. The largest losses came when several layers failed together, not from one universal class of bug.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
