Q3 2026 ranked among the most damaging quarters in crypto security. A small number of exceptionally large breaches—led by Bitget and Liquid Network—concentrated losses in exchanges, signing systems, third-party security software and other operational infrastructure. Hacken’s incident count puts the quarter at $1.18 billion stolen, while CD Security’s broader technical-incident dataset reaches $1.24 billion.
How much was stolen in Q3 2026?
The totals differ because the two firms counted different populations of incidents and applied different classifications. Hacken’s figure is the primary headline measure for stolen funds; CD Security included a broader set of technical losses.
As an Amazon Associate I earn from qualifying purchases.
| Source | Incidents counted | Q3 loss total | What the figure measures |
|---|---|---|---|
| Hacken | 107 | $1.18 billion | Reported stolen value; 55% higher than Q2 |
| CD Security | 146 | $1.24 billion | Broader like-for-like technical-incident losses |
Both datasets show the same pattern: the quarterly total was driven by a handful of failures rather than a uniform increase in the size of every attack. Ninety-eight of Hacken’s 107 incidents were below $10 million, and the median loss was $670,000.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The four incidents that drove the quarter
| Incident | Primary attack surface | Reported loss measure | Response or recovery noted | Residual loss |
|---|---|---|---|---|
| Bitget, September 24 | Third-party security product, privileged credentials and withdrawal controls | Approximately $387.5 million transferred to attacker-controlled addresses; later rounded by Bitget to about $388 million | Protection Fund designated for the financial impact; fund replenished to more than $300 million by September 30 | Not stated |
| Liquid Network | Network and signing infrastructure | About $320 million | Self-described white hats returned about 85% of the stolen value | Not stated |
| Tectonic | Not stated in the incident summary | About $120 million | Not stated | Not stated |
| Coldcard firmware vulnerability | Firmware and key-management exposure | Estimated $115 million | Not stated | Not stated |
The incident summary estimates that these four events represented roughly 80% of Q3 losses. CD Security likewise reports that Bitget, Liquid Network and Tectonic together accounted for about 67% of its broader total.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
What happened in the Bitget hack?
Bitget said unauthorized transfers began at approximately 18:31 UTC on September 24, 2026, from part of its hot- and warm-wallet infrastructure. The exchange’s investigation described a chain of failures rather than a simple wallet-key theft:
- An attacker exploited a vulnerability in a third-party security product.
- The compromise yielded high-level internal credentials.
- Those credentials were used to issue fraudulent withdrawal commands.
- The commands bypassed controls that were expected to block abnormal transactions.
The affected assets moved across Ethereum and other EVM networks, XRP Ledger, Zcash and TRON. Bitget said its investigation identified the attack path, remediated the underlying vulnerability and contained the incident. Its later protection-fund notice described the final affected amount as approximately $388 million.
Bitget also stated that user account balances remained accurate and unaffected. The exchange designated its Protection Fund to cover the incident’s financial impact and reported that the fund had been replenished to more than $300 million by September 30.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
“The underlying vulnerability has been identified and remediated.” — Bitget
What happened to Liquid Network?
The Liquid Network exploit was the second-largest named event in the quarter, with losses estimated at about $320 million. The incident summary says self-described white hats returned approximately $272 million—about 85% of the stolen value. That recovery made Liquid the largest single contributor to the quarter’s returned or reversed funds.
The available summary does not establish a final unrecovered amount for Liquid, so the remaining balance should not be treated as definitively lost or recovered without a later accounting.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Why did crypto hacks reach almost $1.2 billion?
Hacken’s category breakdown assigns 48% of losses to smart-contract exploits and 40% to access-control and operational failures. The figures show that contract code remains a major risk, but it was not the only decisive layer in Q3. Supply-chain compromises, stolen keys, signer failures, weak withdrawal infrastructure and flawed deployment processes all created paths to large losses.
“Q3 2026 was one of the costliest quarters on record for digital asset security.” — Hacken
The concentration effect explains why the quarter’s total can rise sharply even while most individual incidents remain comparatively small. A single exchange compromise or signing failure can move hundreds of millions of dollars, overwhelming the aggregate impact of dozens of sub-$10-million attacks.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Were the stolen funds recovered?
The incident summary reports that about $387 million—roughly 33% of gross Q3 losses—was returned or reversed. The categories used in the summary are not mutually exclusive: a transaction can be reversed, returned by a counterparty or covered by an operator, and reports may classify those outcomes differently.
Operators covered about $410 million of user losses from their own funds, including the amount Bitget assigned to its Protection Fund. Separately, the summary says approximately $384 million, or 32% of gross losses, was neither returned nor covered. Those figures describe different accounting buckets and should not be added together as if they were independent totals.
Free tools Windows power users keep installed
One-click scans. No signup required.
Are smart contracts still the main crypto-hack risk?
They are the largest single category in Hacken’s breakdown, but the quarter demonstrates why a contract-only security program is incomplete. The practical attack surface includes every system that can authorize, construct, sign, route or release a transaction.
- Third-party suppliers: Security products, libraries, cloud services and developer tooling can expose privileged environments.
- Signer and custody controls: Keys, hardware devices, multisignature policies and signing authorities need independent safeguards.
- Withdrawal infrastructure: Velocity limits, address screening and manual escalation must be able to stop anomalous requests.
- Upgrade and deployment paths: Contract upgrades and production changes require independent review and tightly scoped permissions.
- Oracles, bridges and integrations: External data and cross-chain components can introduce failure modes outside the core contract.
Security controls highlighted by the Q3 incidents
- Use least-privilege credentials. Separate administrator, deployment, monitoring and withdrawal roles, and remove standing access that is not required.
- Require independent transaction validation. Compare withdrawals against separate policy engines, allowlists, risk scores and human approvals before signing.
- Monitor suppliers and privileged systems continuously. A clean contract audit does not detect a compromised security product or developer environment.
- Prepare automated incident response. Pre-authorized pauses, withdrawal throttles and key-revocation procedures reduce the time between detection and containment.
- Test recovery and reimbursement plans. Keep reserves, document decision authority and rehearse communication so a fund or rollback can be activated without delay.
- Maintain bug bounties and upgrade reviews. External reports and independent review should cover contract logic, deployment tooling and key-management workflows.
Q3’s losses therefore point to a broader lesson: smart-contract security is necessary, but exchange controls, suppliers, signers and operational processes can determine whether a vulnerability becomes a billion-dollar event.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
