The third quarter of 2026 was one of the most expensive periods on record for crypto security. According to blockchain security firm Hacken, attackers stole $1.18 billion across 107 incidents between July and September, a 55% increase from the second quarter. Cointelegraph noted that it was the most damaging quarter since Q1 2025, when the $1.4 billion Bybit hack pushed losses to about $1.6 billion.
The headline number is only part of the story. Hacken's main warning is that many users trust audit badges too much, while attackers increasingly target the systems that audits do not cover.
Key Findings From the Report
- $1.18 billion lost across 107 incidents, up 55% from Q2
- About $906.8 million, or 77% of losses, came from compromised suppliers or developer tools, publicly known security fixes that had not been deployed, or components outside the latest audit
- Smart contract exploits accounted for 48% of losses, up from 12% in Q2
- Access control and operational failures accounted for 40% of losses, down from 88% in Q2
- Smart contract incidents were the most frequent type, with 71 incidents and about $228 million in losses, according to Cointelegraph
- About 80% of losses were concentrated in four large incidents, while 98 incidents involved losses below $10 million. The median loss was about $670,000
The Biggest Incidents
The largest incident of the quarter was the September attack on the Bitget exchange. According to Hacken's report as summarized by CoinDesk, attackers exploited a vulnerability in a third-party security product to gain access to the exchange's withdrawal infrastructure, causing losses of more than $350 million. Other major incidents included exploits at Liquid Network and Tectonic and a vulnerability linked to Coldcard wallet firmware. Loss estimates for these incidents vary slightly between sources.
Hardware wallets were also in the news outside the Q3 window. In October, Ledger confirmed that some genuine devices sold through CryptoBilis, a reseller in Southeast Asia, contained an unauthorized implant that could capture recovery phrases displayed on screen and transmit them over a mobile network. Blockchain analysts estimate losses of about $93 million across more than 300 wallets, although Ledger has not confirmed that amount. Ledger stated that its software and Secure Element were not compromised.
Why an Audit Badge Is Not a Guarantee
An audit usually covers a specific set of smart contracts at a specific point in time. It often does not include wallets, signing systems, third-party software, oracles, bridges or the operational setup of the team. "The problem is always scope," Hacken co-founder Andrii Matiukhin told CoinDesk, explaining that teams often audit only the most critical parts of a service to save costs.
Hacken also reviewed 12 derivatives exchanges and prediction markets and found that more than $700 million at two major venues depended on a three-of-four signing arrangement or on admin keys whose holders were not publicly identified. The firm said it found no evidence of an active vulnerability but considered these setups inadequate for the amounts involved.
The report recommends that protocols extend security reviews to oracles, bridges, custody systems, signing authorities and other privileged components, and that they apply public security fixes quickly.
Practical Security Lessons for Users
You cannot audit a platform yourself, but you can reduce your own exposure:
- Treat "audited" as one data point, not a guarantee. Check what was audited, when and by whom.
- Buy hardware wallets only from the manufacturer or authorized sellers, and never use a device that arrives with a pre-generated recovery phrase.
- Never type your recovery phrase into a website, app or message, and never share it with "support" staff.
- Review token approvals regularly and revoke those you no longer need.
- Double-check addresses, networks and contract details before every transfer or swap. Sending to the wrong network is a common and costly mistake.
- Do not keep more funds than necessary on any single platform or wallet, and split long-term holdings from trading balances.
- Be cautious with new bridges and cross-chain protocols. Hacken reported that three bridges and cross-chain protocols lost more than $35 million in a single six-hour window in July.
- Enable two-factor authentication on every account and use unique passwords.
What It Means for the Market
Security incidents affect more than the platforms involved. Large hacks can hit sentiment, trigger withdrawals and pressure the prices of affected tokens. At the same time, regulators are paying more attention. Hacken noted that regulators are increasingly testing whether controls work continuously, not just at a single point in time, and are holding specific founders and executives accountable.
For users, the key lesson is simple: security is a shared responsibility. Platforms need broader reviews and faster fixes, and users need careful habits. Whenever you swap supported assets on AviorSwap, which lists 17+ networks, take a moment to confirm the asset, the network and the amount before you confirm.