Cyberattacks on cryptocurrency companies drained more than $1.17 billion in the third quarter of 2026, according to a Finbold Research report based on incident data tracked by blockchain security firm SlowMist. The total marks a sharp acceleration compared with the entire first half of the year, which recorded $955 million in losses.

September was the quarter's most active month, with 50 known incidents affecting $762 million worth of funds. August saw nearly 40 attacks causing close to $188 million in damage, while July recorded 35 incidents resulting in more than $224 million in losses.

Finbold Research calculated the Q3 2026 total using known hack values recorded between July 1 and September 30, 2026. The figures reflect the gross value affected at the time of each incident and may differ from final unrecovered losses once funds are returned, frozen, or recovered.

Five Largest Hacks Accounted for 81% of Quarterly Losses

As in the first half of 2026, the quarter was shaped by a small number of large-scale attacks. The September 24 hack of Bitget alone accounted for $387.5 million, and the five biggest incidents affected a combined $952 million — 81% of the three-month total. That concentration left just under a fifth of the quarterly total spread across the remaining incidents, meaning quarter-level figures can swing sharply on the outcome of a single exploit.

The second-largest incident involved the theft of $320 million worth of Bitcoin (BTC) from the Liquid Network by a group of self-proclaimed "white-hat hackers," who returned the majority of the funds within days. Because the report counts gross value at the time of each incident, the episode still ranks among the quarter's largest despite the return.

The third-largest attack targeted roughly $120 million worth of Tectonic assets and was not entirely successful: the attackers managed to evacuate less than $10 million before the chain was halted and rolled back, a response that limited the final loss to a small fraction of the value initially at risk.

Several other incidents left the perpetrators entirely empty-handed, including the August Oraichain exploit, the Zeus infrastructure compromise in the same month, and the July Across signal spoofing attack.

The fourth-largest incident may have been the most concerning. The Coldcard hack not only affected $100 million worth of funds, but also involved breaching a hardware wallet — a category of device long considered one of the safest ways to store cryptocurrency. Hardware wallets keep private keys offline, which is precisely why many holders rely on them to keep assets beyond the reach of online attackers.

Rounding out the top five, the AFX Bridge exploit resulted in roughly $24.15 in losses after validator signing keys were compromised. Bridges move assets between blockchains and rely on validators to approve transfers, which makes the signing keys that secure them a critical dependency.

2026 Losses Reach $2.1 Billion

The quarter represented a substantial acceleration in cyberattacks on the cryptocurrency space and brought the 2026 total to $2.1 billion — less than $700 million short of the $2.78 billion stolen in 2025.

Notably, unlike the previous year, the amount stolen soared above $2 billion without a singular massive hack akin to the $1.5 billion Bybit incident in the first quarter of 2025.

Q4 Outlook for Crypto Security

The report indicates that 2026 could prove one of the worst years on record. Reporting delays can push a quarterly total higher long after the quarter has ended, and 11 known hacks had already taken place in the first nine days of October — a figure that could still climb as delayed reports come in.

The situation could be further exacerbated by the bull market that began with the August rally, which would both increase the value of every coin or token taken and provide a larger incentive for criminals. The report also flags the rising number of self-proclaimed activist hackers targeting digital assets and other companies as a troubling trend.

Beyond the Liquid Network incident, other supposed "white hat" episodes have emerged across multiple sectors. The gaming industry was targeted by a Grand Theft Auto 6 (GTA6) leaker citing anti-consumer practices, while the Revolut data breach was presented by its perpetrators as punishment for poor consumer protections — to the point that the attackers adopted the moniker "IAmNotAVillain."

Finally, the report notes a recent uptick in artificial intelligence (AI) companies hacking their competitors or national governments as part of "AI agent" tests, suggesting cybercriminals could benefit from new and powerful tools before the end of Q4 2026.