Bitget, Liquid hacks drive crypto losses to $1.18B in Q3
Crypto hacks caused $1.18 billion in losses across 107 incidents in Q3 2026, led by the $387 million Bitget hack and $320 million Liquid exploit, Hacken reported.
Crypto hacks caused $1.18 billion in losses across 107 incidents in the third quarter of 2026, according to security company Hacken. The Bitget hack and Liquid Network exploit accounted for $707 million of the total.
Hacken described the quarter as the most damaging for crypto hacks since the first quarter of 2025, when the $1.4 billion Bybit theft linked to North Korea helped push quarterly losses to $1.6 billion.
About 80% of Q3 losses came from the four largest incidents: the Bitget hack, the Liquid Network exploit, the $120 million Tectonic exploit and a Coldcard firmware vulnerability associated with an estimated $115 million in losses. Of the 107 incidents, 98 caused losses below $10 million. The median loss was $670,000.
Hacken attributed about $906 million, or 77% of Q3 losses, to compromised suppliers or developer tools, fixes that had been disclosed but not deployed, and other components outside security reviews. Smart-contract attacks were the most frequent incident type, accounting for $228 million in losses across 71 cases.
About $387 million, or 33% of the total, was returned or reversed after the attacks. Following the Liquid Network exploit, people describing themselves as white-hat hackers returned $272 million, or about 85% of the stolen funds.
Cronos validators reversed 114 minutes of settled blockchain history after the Tectonic incident. The rollback reversed about $111.2 million of the $120.4 million in affected borrowing. Circle and Tether froze about $340,000 linked to the Bitget theft.
Operators covered another $410 million in user losses from their own funds. Bitget’s user protection fund covered $387 million, while Triple-A, Coinsbuy and TAC repaid about $22 million to users even though the stolen assets remained with the attackers.
About $384 million, or 32% of Q3 losses, was neither returned nor covered, according to Hacken.
Hacken recommended expanding security reviews beyond core code to cover suppliers, developer tools, oracles, bridges, custody systems and signing authorities. The company also recommended stronger controls for third-party providers and other external infrastructure that may fall outside standard audits.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
