8h05 ▪ 4 min read ▪ by Ariela R.
Summarize this article with:
In its quarterly report, Hacken lists 107 incidents and $1.18 billion stolen in the third quarter of 2026 within the crypto sphere. It attributes 77% of this total to audit blind spots: a compromised crypto provider, an undeployed patch, or a component outside the latest review. Only 14% of the losses fall under the last case, and about $384 million were neither recovered nor covered.
In brief
- $1.18B stolen in 107 incidents in Q3 2026, a +55% increase over Q2, with the base counting only incidents of at least $250,000, according to Hacken.
- Eleven incidents out of 107 (i.e., 10%) concentrate 77% of the losses, according to our calculations based on the Hacken report.
- About $384M, or 32% of the total, were neither recovered nor covered by operators, according to Hacken.
What does a crypto audit cover against the $1.18B stolen in the third quarter of 2026?
A crypto audit describes a scope at a given date that itself sells audits, Hacken recalls in its Q3 2026 report. However, three attack vectors concentrated $906.8 million. That represents 77% of the losses, in just 11 incidents (see table below).
The heaviest case is that of the crypto exchange Bitget. According to SlowMist and Mandiant, $387.5 million stolen on September 24, 2026 via a vulnerability in a third-party security product.
| Attack Vector | Loss | Incidents | Share of losses |
| Compromised provider or development tool | $411.5M | 2 | 35% |
| Undeployed public patch | $324.8M | 4 | 28% |
| Component outside last review | $170.5M | 5 | 14% |
Only the last vector targets a component outside review, accounting for $170.5 million. This represents 14% of the losses. In this context, Tectonic accounts for about 70%. According to our calculations, that equals $120 million out of $170.5 million.
Hacken lists four crypto audits there. However, the exploited risk parameters were not within the reviewed scope: $120.4 million were borrowed in a single transaction.
An audit is a piece of evidence, not a legal refuge.
Krish Gosai, Gosai Law, Hacken Q3 2026 report, October 2026
What does this result change for crypto investors?
The $1.18 billion figure is a gross amount. It does not measure the final loss of crypto users in any way. According to Hacken:
- about $387 million have been returned or canceled;
- about $410 million covered by the operators (including $387.5 million by Bitget’s protection fund);
- about $384 million were neither recovered nor covered.
On the crypto regulation side, ESMA launched on July 8, 2026, a common supervisory action on custody by providers authorized under MiCA. National authorities will verify key management, crypto incident response, and third-party dependencies. Hacken sees a model change: crypto licensing becomes the start of continuous supervision.
National controls will continue until the first half of 2027, then ESMA will consolidate their results in a report to its Supervisory Board in the second half of 2027. Until then, Hacken recommends institutional crypto players retest their systems after each update, parameter change, or security alert.
Maximize your Cointribune experience with our "Read to Earn" program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
Join the program
A
A
Ariela R.
My name is Ariela, and I am 31 years old. I have been working in the field of web writing for 7 years now. I only discovered trading and cryptocurrency a few years ago, but it is a universe that greatly interests me. The topics covered on the platform allow me to learn more. A singer in my spare time, I also cultivate a great passion for music and reading (and animals!)
DISCLAIMER
The views, thoughts, and opinions expressed in this article belong solely to the author, and should not be taken as investment advice. Do your own research before taking any investment decisions.