According to a report released Thursday by blockchain security firm Hacken, cybercriminals stole $1.18 billion across 107 incidents during the third quarter of 2026, up 55% from the previous quarter. The vast majority of losses ($906.8 million) resulted from compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components that were excluded from the most recent security review.
The findings cast doubt on the protection afforded by audit badges commonly displayed by crypto projects. Hacken co-founder and board director Andrii Matiukhin told CoinDesk that the issue is always scope: "It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service."
Matiukhin said customers often assume an audit covers an entire platform when in reality it may examine only specific smart contracts, leaving wallets, signing systems and third-party software outside its scope. "Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested," he said.
The biggest single incident in Q3 was the September attack on crypto exchange Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to access its withdrawal infrastructure, according to the report. Other notable incidents include hardware wallet maker Ledger discovering an unauthorized hardware "spy" implant in a device sold by a Southeast Asian reseller, resulting in about $93 million in losses. Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, with AFX Trade accounting for $24 million of that after attackers gained control of its validator keys. Other attacks saw losses of $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software.
Hacken also reviewed 12 derivatives exchanges and prediction markets, finding that more than $700 million in secure assets at two major venues depended on signing arrangements considered inadequate for the amounts involved. Matiukhin declined to identify the venues but said there was no evidence of an active vulnerability, though the key setups were not sufficiently secure.
The report also highlighted delays in fixing known vulnerabilities, especially when multiple blockchains rely on the same software but update at different times. Matiukhin noted that sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or declined. Hacken said the responsibility lies with companies holding customer funds to track vulnerabilities and install fixes promptly, rather than relying on an audit completed months or years earlier.