Crypto Hacks Rise 55% to $1.18 Billion in Q3 as Key-Related Losses Fall 30%
Crypto theft losses climbed 55% to $1.18 billion in the third quarter of 2026, even as losses associated with access-control and operational failures fell by about 30%, according to security firm Hacken. Its October 15 disclosure recorded 107 incidents between July and September, up from 67 in the second quarter, highlighting how different weaknesses across smart contracts, authorization systems and transaction validation can drive losses across the crypto industry.
The quarterly figures suggest that overall losses cannot be understood through a single security category. Smart contract-related losses accounted for 48% of the third-quarter total, compared with approximately 11% in Hacken's original second-quarter summary. Meanwhile, the share attributed to access-control and operational failures declined, illustrating the importance of examining both the frequency and severity of incidents.
Hacken Reports a Shift in Crypto Security Losses
Hacken's second-quarter summary recorded $763.9 million in losses across 67 incidents. It attributed 88.3% of those losses to compromised keys, signers and infrastructure. Applying that percentage to the quarterly total produces approximately $675 million in losses associated with those weaknesses.
For the third quarter, Hacken classified 40% of the $1.18 billion total as access-control and operational failures, equivalent to approximately $472 million. That represents a decline of around 30% compared with the second-quarter calculation.
The smart contract figures moved in the opposite direction. The third-quarter share of 48% implies approximately $566 million in losses, compared with roughly $84 million when the second-quarter total is calculated using the original 11% share.
However, differences in category descriptions, rounded figures and the comparability of the underlying classifications mean the figures do not support a precise growth multiple. The published breakdown nevertheless points to a substantially greater contribution from smart contract losses in the third quarter.
Incident frequency also changed. Dividing the reported losses by the number of incidents produces an arithmetic average of approximately $11.4 million per incident in the second quarter and $11 million in the third. The increase in total losses therefore coincided with more incidents, even though the average calculated loss per incident was slightly lower.
Hacken attributed 75.5% of second-quarter losses to just two incidents involving Drift Protocol and KelpDAO. Smart contract bugs appeared in 44 of the quarter's 67 incidents but accounted for only about 11% of the total value lost.
These figures show why incident counts, average losses and category shares need to be considered together. A lower share of aggregate losses does not necessarily mean that a particular weakness has become less important to an institution, whose exposure depends on its systems and safeguards.
Bitget Incident Exposed Withdrawal Authorization Weaknesses
Bitget's September 24 incident demonstrated how attackers can exploit internal authorization processes without compromising private keys. In an investigation update dated September 30, the exchange said compromised third-party security products enabled unauthorized access to its wallet environment.
Bitget's October 14 account said attackers obtained high-privilege internal credentials and injected forged withdrawal commands. The exchange stated that investigators ruled out private-key compromise and that cold wallets were unaffected.
The distinction is important because protecting a signing key does not automatically secure the systems permitted to request its use. If attackers gain control of a trusted internal process, they may be able to submit unauthorized instructions even when the underlying private key remains secure.
Bitget initially estimated that approximately $351.6 million was affected. Its September 25 update raised the figure to about $387.5 million after additional assets were included. The October account placed the final verified amount at approximately $388 million.
The exchange attributed the revisions to a more complete accounting of the original unauthorized transfers. The changing estimates also demonstrate why an initial incident figure and a final assessment may describe different stages of the same event.
Liquid Loss Highlighted Asset Validation and Release Controls
A separate September incident involving Liquid exposed a different security weakness: the validation of assets before they were released. In its September 23 assessment, Blockstream said a defect in an Elements range-proof cache allowed approximately 4,000 unbacked liquid staking token LBTC to pass validation.
Blockstream traced the problem to a cache-bug fix that added missing fields without unambiguous length framing. Different arrangements of those fields could produce identical input bytes, allowing an invalid proof to reuse a cached result from a valid check.
SideSwap, which processed the peg-out converting LBTC into $BTC, acknowledged that it automatically handled the order involving roughly 4,000 LBTC without checks based on transaction size, velocity or wallet history. It said online keys and automatic forwarding eliminated a manual opportunity to hold the Bitcoin before release.
Blockstream said the peg-out authorization key had not been stolen or forged. Instead, the authorization process operated on assets that the network had already accepted incorrectly. SideSwap also said none of its keys, wallets or systems had been compromised.
The incident therefore involved two separate security boundaries: whether an asset was valid and whether it could be released. A pause, transaction limit or manual review at the release stage could have provided another opportunity to interrupt the transfer after the validation failure.
Recovery and Customer Protection Address Different Risks
Blockstream's September assessment recorded 3,400 $BTC returned on September 7, with approximately 602 $BTC still outstanding at the time of its report.
Bitget, meanwhile, said customer balances were unaffected, its Protection Fund covered the financial impact of the incident, and phased withdrawals resumed on October 2. Those statements address customer balances, financial coverage and the restoration of service, rather than the original security weakness alone.
Together, the Bitget and Liquid incidents illustrate different ways crypto assets can leave a system without the theft of a private key. Bitget's account centered on compromised withdrawal instructions, while Liquid's outcome involved faulty asset validation and an operational process that allowed Bitcoin to be released afterward.
Hacken's third-quarter figures add a broader lesson for crypto security planning. Institutions cannot determine their most important safeguards solely by looking at the category responsible for the largest losses in the previous quarter. Security reviews also need to examine whether independent checks can stop a transaction when an earlier control fails.
source: cryptoslate
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.