Bitget and Liquid Breaches Drive Q3 Crypto Hacks Toward $1.2B

Crypto hacks drove an estimated $1.18 billion in losses across 107 recorded incidents in the third quarter of 2026, according to a report by security firm Hacken. While that figure reflects a particularly heavy quarter, the same dataset also suggests that a meaningful share of stolen value was later returned, reversed, or covered.

Hacken’s analysis points to a breakdown in responsibility: 77% of the total—about $906 million—was linked to compromised third-party suppliers, developer tools, publicly disclosed vulnerabilities that had not been deployed, or other components outside typical security review scopes. The quarter also featured several headline-grabbing breaches, including a $387 million Bitget hack, a $320 million Liquid Network exploit, a $120 million Tectonic exploit, and a Coldcard firmware vulnerability associated with an estimated $115 million loss.

Key takeaways

• $1.18 billion was reported lost in Q3 2026 across 107 crypto hack incidents, with the quarter described by Hacken as the most damaging since Q1 2025.
• Supplier and tool-chain failures accounted for 77% (about $906 million) of losses, highlighting security gaps beyond audited code.
• Smart contract attacks were the most common vector by incident count, totaling $228 million across 71 incidents.
• Roughly 33% of gross losses—about $387 million—was later returned or reversed, while $384 million (32%) remained unresolved.
• Most incidents were smaller: 98 of the 107 events involved losses under $10 million, and the median loss was $670,000.

Why Q3 was unusually severe for crypto security

Hacken frames Q3 2026 as a step change in damage compared with earlier quarters, noting it was the most damaging period for crypto hacks since Q1 2025. In that earlier quarter, Bybit suffered $1.4 billion in losses attributed to North Korea, pushing total losses to $1.6 billion—a reference point Hacken uses to contextualize how heavy Q3 2026 was.

Even within Q3 2026, the distribution of harm was uneven. Hacken reports that about 80% of losses were concentrated in four of the largest incidents. At the other end of the spectrum, 98 of the 107 incidents recorded losses below $10 million, and the median incident loss came to $670,000. That combination—few very large events plus many smaller ones—helps explain why aggregate figures can mask the scale of day-to-day exposure for many teams.

The role of supply chains and external tooling

One of the most consequential findings in Hacken’s quarter overview is where the failures tended to occur. According to the report, 77% of losses stemmed from issues that often fall outside traditional internal security reviews: compromised third-party suppliers, weaknesses in developer tools, fixes that were publicly disclosed but not implemented, and other external components.

This distinction matters for investors and protocol operators because it shifts the focus away from purely “smart contract code correctness” and toward the broader ecosystem that modern systems depend on. If the biggest losses can originate in signing systems, custody environments, upstream dependencies, or other privileged external infrastructure, then security programs that only cover repository code may still leave critical gaps.

Consistent with that theme, Hacken urged the industry to tighten security practices around third-party suppliers and developer tools. The firm also recommended that protocol teams broaden their security audit scope to include oracles, bridgers, custody systems, signing authorities, and other privileged components.

Smart contracts were frequent targets, but not the only problem

While supply-chain and infrastructure issues accounted for most of the stolen value, smart contract incidents were the most frequent attack vector. Hacken estimates that smart contract-related compromises produced $228 million in losses across 71 incidents, making them the dominant category by incident count within Q3 2026.

That split between “most frequently exploited” and “largest losses” is important. It suggests that many attackers are able to find repeatable weaknesses in contract logic or common patterns, but the biggest dollar totals may come when larger systemic failures—such as compromised external components—allow attackers to extract value at scale.

Among the largest incidents, several were tied to widely followed exploits and vulnerabilities covered by earlier reporting. These include the Bitget hack, the Liquid Network exploit, the Tectonic exploit, and the Coldcard firmware vulnerability.

How much of the money came back—and what that implies

A major practical question for users after any hack is how much value is recoverable. Hacken reports that of the $1.18 billion lost in Q3 2026, approximately $387 million was returned or reversed—about 33% of gross losses.

One of the largest recovery pathways came after the Liquid Network hack, where self-described “white hats” returned $272 million, representing about 85% of the stolen value, according to coverage summarized in earlier reporting from Cointelegraph (Liquid white hats return 270m).

For the Tectonic incident, Hacken notes that Cronos validators rolled back 114 minutes of settled blockchain history, reversing about $111.2 million of $120.4 million in affected borrowing. In addition, Circle and Tether froze about $340,000 tied to the Bitget theft (as described in earlier reporting referenced by Cointelegraph’s coverage of the Tectonic fallout and related freezing actions).

Hacken also finds that operators covered an additional $410 million of user losses from their own funds. The report credits Bitget’s user protection fund with covering $387 million, while other entities—Triple-A, Coinsbuy and TAC—repaid about $22 million. Even with these interventions, Hacken says some value remained with attackers: $384 million, or 32% of gross losses, was neither returned nor covered.

Taken together, these numbers imply that recovery outcomes in crypto hacks can be highly uneven. They also highlight why “restoration” mechanisms—whether via voluntary returns, protocol-level reversals, freezes, or insurance-like protection funds—can materially affect the net harm experienced by users.

Looking ahead, the most important uncertainty is whether the industry can prevent the kinds of third-party and privileged-component failures that drove the majority of Q3 losses. Investors and builders should watch for broader audit coverage and stronger supply-chain controls—alongside continued scrutiny of how often “publicly disclosed” vulnerabilities remain unpatched until after a major incident.

This article was originally published as Bitget and Liquid Breaches Drive Q3 Crypto Hacks Toward $1.2B on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.