Crypto’s third-quarter security bill came to $1.18 billion, but the headline total is only part of Hacken’s latest warning. The firm recorded 107 incidents between July and September, with smart-contract exploits taking a much larger share of losses than they did three months earlier.
TL;DR: Hacken reported $1.18 billion stolen across 107 incidents in Q3 2026, up 55% from Q2. Smart-contract exploits accounted for 48% of losses, compared with 12% in the previous quarter. Access-control and operational failures made up 40%.
According to Hacken’s Q3 2026 Security and Compliance Report, the pattern behind attacks changed sharply. In Q2, access-control and operational failures had accounted for 88% of losses. That share fell to 40% in Q3, even as total damage rose. Smart-contract losses moved in the other direction, rising from 12% to 48%.
That doesn’t mean wallet keys, infrastructure and vendors stopped being dangerous. Hacken says the largest individual losses were linked to supply-chain attacks, compromised keys, and weaknesses in signer and withdrawal systems. Meanwhile, smart-contract and protocol-code vulnerabilities continued to account for a large number of incidents.
Those distinctions matter when projects point to completed code audits as proof that funds are safe. A contract review can catch defects in one component, but it cannot by itself secure the signing processes, deployment infrastructure and third-party software that surround it.
The report also highlights recurring attack techniques and cases where fixes were already public before exploits happened. That is a less comforting picture for teams relying on one-off reviews rather than continuous checks.
For users and investors, the takeaway is practical: a security audit is worth reading, but its scope, date and follow-through matter as much as the badge on a website.
Written by the News Desk and edited by Samuel Rae.