Crypto Hackers Steal 1.26 Billion Dollars in Third Quarter 2026
Cryptocurrency platforms lost 1.26 billion dollars to security exploits during the third quarter of 2026, marking the worst quarterly theft figures of the year despite a price rally of about 40 percent in Bitcoin over the same period. Total losses for the year have now reached 2.68 billion dollars, driven primarily by infrastructure vulnerabilities rather than simple phishing scams.
The third quarter spike brings cumulative losses to severe levels while industry insurance capacity drops and security failures concentrate heavily in two major attacks.
Third Quarter Losses Peak in September
Security firm CertiK recorded 247 incidents during the third quarter, up from 219 incidents in the second quarter. September proved to be the most destructive month of the year in gross terms, accounting for 768.5 million dollars stolen across 99 separate incidents. Code and infrastructure flaws caused 95 percent of September’s damage, totaling 733.8 million dollars across 58 incidents, whereas phishing attacks accounted for just 6.2 million dollars.
Recovery efforts clawed back some funds during the month. CertiK reported that 273.2 million dollars were frozen or recovered in September, bringing net losses for the month down to 495.3 million dollars. Adjusted losses for the entire quarter reached 869.6 million dollars, representing a 10 percent increase over the second quarter. Meanwhile, DefiLlama tracked roughly 1.25 billion dollars lost across 116 incidents using a more restrictive methodology.
Bitget and Liquid Network Suffer Major Exploits
Two primary events accounted for over half of the entire third quarter’s financial damage. On September 24, trading platform Bitget suffered an outflow of 387.5 million dollars from its hot wallets. Gracy Chen explained that an attacker exploited a vulnerability in a third-party service provider’s security product to obtain high-level internal credentials, subsequently issuing unauthorized withdrawal orders without compromising private keys or cold storage.
Earlier in the quarter, Liquid Network experienced a security breach on September 6 caused by a bug in the cache verification of rangeproofs, which are the cryptographic proofs validating confidential amounts. The flaw allowed the unauthorized creation of L-BTC worth approximately 319 million dollars. The attacker returned 3,400 Bitcoin the following day, though roughly 600 Bitcoin remain missing.
Additional significant incidents included an attack on Cronos lending protocol Tectonic on August 30, which CertiK estimated at 120 million dollars after an exploiter inflated the price of the TONIC token. Cronos validators subsequently rolled back the chain to the block preceding the attack, though approximately 6 million dollars had already moved to Ethereum. A hardware vulnerability involving a 2021 Coldcard firmware update weakened seed generation, allowing attackers to siphon 1,778 Bitcoin—valued at 112.7 million dollars by CertiK—from more than 5,200 addresses between July 30 and August 6.
Insurance Capacity Contracts as Bitcoin Rallies
While Bitcoin gained approximately 40 percent during the third quarter in its strongest performance since 2024, the crypto sector’s insurance capacity dwindled. According to CoinGecko’s 2026 security report, total insurance capacity fell to 130.2 million dollars by the end of August, down from 163.2 million dollars a year earlier. This available pool covers less than 5 percent of the 2.68 billion dollars stolen since January.
Actual payouts remain minimal. Insurers disbursed only about 33 million dollars between January 2025 and July 2026, representing barely 0.9 percent of total losses. Market contraction accompanied this trend, as five of the nine on-chain insurance protocols tracked by CoinGecko shut down or abandoned crypto coverage entirely.
Infrastructure Vulnerabilities Persist Into October
Nicolai Sondergaard, an analyst at Nansen, told CoinDesk that repeated exploits reinforce the reality that crypto infrastructure remains operationally fragile. Oliver Carding of Tesseract Group added that automated artificial intelligence tools now allow malicious actors to scan for smart contract vulnerabilities much faster than human engineers once could.
The wave of security breaches extended into the final quarter. On October 1, NEAR Intents lost 3.8 million dollars in user funds due to a bug between its Omni deposit and withdrawal infrastructure and its smart contract. The protocol had previously frozen 50 million dollars linked to the Bitget exploit and pledged a full reimbursement to affected users.
Frequently Asked Questions About Third Quarter Crypto Hacks
How much money was lost to crypto hacks in the third quarter of 2026?
Cryptocurrency platforms lost approximately 1.26 billion dollars during the third quarter of 2026 across 247 incidents recorded by CertiK, with September alone accounting for 768.5 million dollars.
Which security incidents caused the largest losses?
The two largest exploits involved Bitget, which lost 387.5 million dollars on September 24 via compromised internal credentials, and Liquid Network, which suffered a 319 million dollar breach on September 6 due to a rangeproof verification bug.
How do insurance payouts compare to total crypto losses?
Insurers paid out only about 33 million dollars between January 2025 and July 2026, which covers just 0.9 percent of the 3.63 billion dollars lost over that broader timeframe, according to CoinGecko data.
Worth a look