Bitcoin (BTC) closed the third quarter up 40% at $84,735.75, outrunning every major asset even as U.S. Treasury yields climbed to their highest levels in more than two decades. Investors poured billions of dollars into exchange-traded funds (ETFs) tied to BTC and other tokens, several altcoins rallied even harder, and analysts were left convinced that a new bull run has arrived. As the new quarter got underway, bitcoin was back trading in the familiar $82,000-$85,000 price range (CoinDesk).

Yet amid the rally, one familiar stain on the industry's image kept spreading: hacks and exploits. The money lost in these incidents is small next to the billions flowing into ETFs, but the damage to crypto's reputation is harder to wave away.

Crypto suffered 247 security incidents in the third quarter, with losses totaling $1.26 billion, according to data tracked by crypto security firm CertiK. Losses for the year so far stand at $2.68 billion. September was the worst month yet, with 99 incidents — the most since February 2025 — and $768.5 million stolen, the largest monthly haul of 2026.

"Yes, it is bad optics," Nicolai Sondergaard, senior research analyst at Nansen, toldDesk. "The reputational damage can still be larger than the losses themselves. Repeated exploits reinforce the idea that crypto infrastructure remains operationally fragile, which can slow institutional adoption, increase scrutiny from regulators and custodians, and make allocators demand a higher risk premium."

For now, the losses barely register against the capital arriving through ETFs, Sondergaard explained, adding that most institutions are buying crypto through regulated, familiar wrappers and staying away from DeFi protocols altogether.

CertiK said the numbers show how deeply rooted the problem remains. "September was a stark reminder of how quickly the threat landscape can shift. With both losses and incident count reaching their highest levels of 2026, the month's data reinforces the need for security across every layer," the firm said in a post on X. The opening weeks of the fourth quarter will show whether that shift persists.

Insurance safety net remains small and shrinking

The insurance safety net remains relatively small and is shrinking relative to the risks. CoinGecko's State of Crypto Security Report 2026, released at the end of August, noted this trend and put on-chain crypto insurance coverage capacity at $130.2 million, down 20.2% from $163 million last year. Set against September's $768.5 million in stolen funds, the sector's entire on-chain capacity would cover only a fraction of a single month's losses — a shortfall that leaves the bulk of this year's incident losses without on-chain coverage.

Overall, the insurance sector has struggled to match the risks. As CoinDesk noted early this year, crypto users have been choosing juicy yields over protection, putting billions of dollars at risk of hacks.

AI adds a fresh threat

Amid all this, artificial intelligence (AI) is adding a fresh threat to the landscape.

"My longer-term concern is speed, now AI tools are automating the hunt for weaknesses in smart contracts, work that used to take a skilled engineer months. That shortens the time anyone has to fix a flaw before it is used," Oliver Carding, head of marketing at Tesseract Group, said in an email.

Security firm Blockaid expects multiple incidents involving AI agents, with prompt injection — where hidden instructions trick an AI agent into acting against its user — the most likely route of attack. For exchanges, wallet providers and protocol teams, that makes AI-agent behavior and prompt-injection defenses a clear item on the security watch list for the months ahead.

The bull market may be back, but so are the malicious entities trying to cash in on its weak spots.

Around the markets

MetaMask security incident forces Ethereum staking exits, no funds at risk (CoinDesk): MetaMask is pulling Ethereum staking systems out of service after a security incident, with Lido warning of lost rewards and a security researcher reporting that payments from producing blocks were diverted to another wallet. The episode landed on the quarter's first day, an early reminder that the security pressures documented in the third quarter had carried straight into October.

10-year Treasury yield hits highest level since 2002 as global bond rout gathers pace (CNBC): U.S. Treasury yields hit their highest level in more than two decades on Thursday as a global bond sell-off deepened. The yield on the 30-year Treasury bond jumped 3 basis points to 5.6702%, its highest level since July 2002. The 2-year yield was 2 basis points higher at 4.91%.

EU questions Binance over continued operations despite wind-down order (FT): EU officials are questioning Binance over its use of a legal exemption to continue serving customers in the region despite an order to wind down its business in the bloc.

Citigroup raises 12-month bitcoin target to $113,000 as ETF inflows resume (CoinDesk): Citi expects slow but steady inflows into products like ETFs as advisers and brokerages favor gradual increases in bitcoin allocations, forecasting $5 billion of inflow over the next 12 months — a figure that gives the market a concrete benchmark against which to measure actual flows.

Technical signal: ETH/BTC uptrend stalls

After a steep climb through July and August, the Binance-listed ether-bitcoin (ETH/BTC) ratio's uptrend has stalled. Repeated failures to sustain momentum above 0.033, followed by sideways churn, have broken the bullish trendline.

That shift puts the Ichimoku cloud in focus: a decisive break below the cloud would confirm a bearish trend reversal, pointing to a renewed downtrend for ether against bitcoin.

Also making headlines

• Payments firm OpenPayd targets a year-end Nasdaq listing to fund U.S. expansion and acquisitions.
• Crypto job postings tripled to more than 1,200 in September, but applications fell.
• Cathie Wood says smart investors need to start watching where AI agents spend money.
• Crypto's Sisyphean struggle (Opinion).
• BlackRock offers a glimpse of how tokenization may change your investment portfolio.
• A bank group is suing a U.S. regulator over the granting of crypto trust charters.
• BNY is in talks with Kraken parent Payward over an infrastructure partnership.
• Blast, once a $2 billion Ethereum layer-2, is shutting down after assets plunged 98%.
• Trump's potential AI czar, Jay Clayton, helped pioneer the SEC's crypto crackdown.
• America at a crossroads: Commissioner Peirce's parting challenge (Opinion).

Stablecoin focus: Asia-Pacific

CoinDesk Research's "The Definitive Stablecoin Landscape Series: Asia Pacific" maps the region's rules, use cases and the role of RLUSD as stablecoins move into regulated finance, with the Asia-Pacific region emerging as a key proving ground.

This article is adapted from CoinDesk's Daybook newsletter, a day-ahead look at the crypto market, dated Oct. 1, 2026.