Q3 Sees Crypto Hacks Surge to $1.18 Billion, Driven by Supply Chain Exploits

The third quarter of 2026 proved to be a particularly damaging period for the cryptocurrency industry, with security breaches leading to a staggering total loss of $1.18 billion. This figure, compiled from 107 distinct incidents, marks one of the highest quarterly totals seen in recent years. The nature of these attacks highlights evolving threats within the digital asset space, moving beyond simple smart contract vulnerabilities to more complex supply chain and infrastructure-related compromises.

Key players in the Q3 exploits included major platforms and projects, with the Bitget hack accounting for $387 million and the Liquid Network exploit resulting in $320 million in losses. Other significant incidents involved the Tectonic exploit, causing $120 million in damage, and a Coldcard firmware vulnerability linked to an estimated $115 million loss. These four events alone represented a substantial portion of the quarter's total losses, underscoring the systemic risk posed by large-scale exploits.

A significant factor contributing to the high losses was the exploitation of third-party suppliers, developer tools, and infrastructure components that fell outside of standard security audits. According to security firm Hacken, approximately 77% of the quarter's total losses, amounting to about $906 million, stemmed from these types of vulnerabilities. This trend suggests a critical need for enhanced due diligence and security practices concerning the entire ecosystem surrounding digital asset platforms, not just their core code.

The market's reaction to these exploits was mixed, with some funds being recovered or covered. Roughly 33% of the total stolen funds, approximately $387 million, were either returned or reversed through various means. For instance, white-hat hackers returned a large portion of the Liquid Network's stolen funds, and the Tectonic incident saw blockchain history rolled back to reverse losses. Additionally, some platform operators covered user losses from their own reserves, aiming to maintain customer trust.

The concentration of losses in a few major incidents, while most individual hacks were smaller, indicates a pattern of high-impact attacks targeting critical infrastructure or well-funded platforms. The median loss across all 107 incidents was $670,000, showing that while large-scale breaches dominate the headlines and total loss figures, a significant number of smaller, yet frequent, incidents involving smart contracts ($228 million across 71 events) continue to plague the sector.

Looking ahead, traders and platforms should closely monitor the cybersecurity practices of exchanges, decentralized finance (DeFi) protocols, and their associated third-party service providers. The prevalence of supply chain attacks suggests that strengthening external dependencies and expanding the scope of security audits to include all integrated components, such as oracles and signing authorities, will be paramount. The industry's ability to adapt and fortify these weaker links will be crucial in mitigating future losses and maintaining confidence in the digital asset market.

---

Source: Cointelegraph. Summarized and rewritten by the Vexoda Newsroom. This is market news, not financial advice.