Crypto: 107 Incidents and $1.18B Stolen in Q3 2026

In its quarterly report, Hacken lists 107 incidents and $1.18 billion stolen in the third quarter of 2026 within the crypto sphere. It attributes 77% of this total to audit blind spots: a compromised crypto provider, an undeployed patch, or a component outside the latest review. Only 14% of the losses fall under the last case, and about $384 million were neither recovered nor covered.

What does a crypto audit cover against the $1.18B stolen in the third quarter of 2026?

A crypto audit describes a scope at a given date that itself sells audits, Hacken recalls in its Q3 2026 report. However, three attack vectors concentrated $906.8 million. That represents 77% of the losses, in just 11 incidents (see table below).

The heaviest case is that of the crypto exchange Bitget. According to SlowMist and Mandiant, $387.5 million stolen on September 24, 2026 via a vulnerability in a third-party security product.

Attack Vector	Loss	Incidents	Share of losses
Compromised provider or development tool	$411.5M	2	35%
Undeployed public patch	$324.8M	4	28%
Component outside last review	$170.5M	5	14%

Only the last vector targets a component outside review, accounting for $170.5 million. This represents 14% of the losses. In this context, Tectonic accounts for about 70%. According to our calculations, that equals $120 million out of $170.5 million.

Hacken lists four crypto audits there. However, the exploited risk parameters were not within the reviewed scope: $120.4 million were borrowed in a single transaction.

An audit is a piece of evidence, not a legal refuge.

Krish Gosai, Gosai Law, Hacken Q3 2026 report, October 2026

What does this result change for crypto investors?

The $1.18 billion figure is a gross amount. It does not measure the final loss of crypto users in any way. According to Hacken:

• about $387 million have been returned or canceled;
• about $410 million covered by the operators (including $387.5 million by Bitget’s protection fund);
• about $384 million were neither recovered nor covered.

On the crypto regulation side, ESMA launched on July 8, 2026, a common supervisory action on custody by providers authorized under MiCA. National authorities will verify key management, crypto incident response, and third-party dependencies. Hacken sees a model change: crypto licensing becomes the start of continuous supervision.

National controls will continue until the first half of 2027, then ESMA will consolidate their results in a report to its Supervisory Board in the second half of 2027. Until then, Hacken recommends institutional crypto players retest their systems after each update, parameter change, or security alert.