The total cost of attacks on the cryptocurrency sector reached $1.18 billion in the third quarter of 2026, according to a report published by cybersecurity firm Hacken, which documented 107 security incidents between July and September 2026.

Approximately 77 percent of the losses, or $906 million, stemmed from compromised suppliers, developer tools, unimplemented security patches, and infrastructure components that fell outside the scope of standard smart contract audits, the report said. The breakdown indicates that most of the quarter's financial damage came from areas standard smart contract audits do not examine, making supplier, tooling, and infrastructure security a core part of the sector's risk picture alongside contract-level reviews.

Four Incidents Drive Bulk of Losses

The four largest incidents accounted for roughly 80 percent of the total losses. Hacken estimated the cost of the Bitget attack at $387 million, the Liquid Network incident at $320 million, and the Tectonic attack at approximately $120 million. Losses related to the Coldcard firmware vulnerability were estimated at around $115 million.

While smart contract attacks did not rank first in monetary value, they were the most frequent type of incident. A total of 71 smart contract incidents resulted in losses of approximately $228 million. Smart contract exploits therefore remained the most common attack vector by incident count, even though infrastructure compromises drove the majority of the financial damage.

Of the 107 recorded incidents, 98 produced losses below $10 million, with a median loss of $670,000. That distribution shows a long tail of comparatively small events behind the headline breaches, meaning the quarter's overall total was shaped by a handful of large cases rather than by typical incident sizes.

Recoveries Reduce the Toll

Of the $1.18 billion that went missing, approximately $387 million was later recovered or reversed. In the Liquid Network incident, individuals identifying themselves as white-hat traders returned $272 million. In the Tectonic case, approximately $111.2 million worth of transactions were reversed after Cronos validators retrieved the blockchain history.

Platform operators also covered $410 million of user losses from their own resources. Despite these measures, approximately $384 million remains unrecovered or uncompensated by the companies, the portion of the quarter's losses left unresolved after white-hat returns, transaction reversals, and operator compensation.

This is not investment advice.