Crypto Hacks: $1.26 Billion Stolen in Q3 While Bitcoin Rises 40%

Bullish rally, record loot. Hackers stole $1.26 billion in crypto in the third quarter of 2026. Meanwhile, Bitcoin gained about 40% during the same period. The total bill has reached $2.68 billion since January.

September is the worst month of the year in terms of raw figures, with $768.5 million stolen. The Bitget hack alone accounts for nearly a third of the quarter. At the same time, the insurance capacity of the sector has decreased by 20% over the past year. Key points of this article:

• The third quarter of 2026 cost crypto platforms $1.26 billion, the worst quarter of the year.
• Bitget ($387.5 million) and Liquid Network ($319 million) together account for more than half of the total.
• Insurers have compensated only 0.9% of the losses incurred since early 2025.

Crypto Hacks: $1.26 Billion Vanished in Q3

CertiK recorded 247 incidents in the quarter, compared to 219 in the second. According to Cointelegraph, losses surged by 53.9% compared to the $819.4 million in spring. September alone accounted for $768.5 million in losses across 99 incidents.

Code and infrastructure vulnerabilities caused most of the damage. They represent 95% of the September bill ($733.8 million across 58 incidents). Phishing, on the other hand, peaked at $6.2 million.

CertiK specifies that $273.2 million has been frozen or recovered. Thus, the net losses for September drop to $495.3 million. The adjusted losses for the quarter reach $869.6 million, which is 10% more than in the second quarter. DefiLlama, for its part, counts about $1.25 billion lost across 116 incidents. However, its methodology is more restrictive. Amounts hacked each month since July 2025, with September 2026 leading at over $700 million. Source: DefiLlama

Bitget and Liquid Network: Over $700 Million Between Them

Bitget saw $387.5 million leave its hot wallets on September 24. The attacker first exploited a vulnerability in a security product from a third-party provider. They then obtained high-level internal credentials and issued fake withdrawal orders. Neither the private keys nor the cold storage were affected, according to CEO Gracy Chen.

Liquid Network kicked things off on September 6. The bug originated from the verification cache of rangeproofs (the cryptographic proofs that validate confidential amounts). It allowed the creation of L-BTC without collateral for about $319 million. However, the hacker returned 3,400 BTC the very next day. About 600 BTC are still unaccounted for.

CertiK estimates the attack on August 30 against Tectonic, a lending protocol on Cronos, at $120 million. The hacker inflated the price of the TONIC token nearly 100 times in twenty minutes. Most other estimates hover around $75 million. The validators of Cronos subsequently rewound the chain to the block preceding the attack. However, about $6 million had already slipped towards Ethereum.

The Coldcard vulnerability dates back to a firmware update in 2021. This had weakened the generation of seeds. Hackers took advantage of this between July 30 and August 6. They siphoned off 1,778 BTC from over 5,200 addresses, amounting to $112.7 million according to CertiK. Galaxy Research estimates that the loot could rise to 2,417 BTC with a fourth wave.

Bitcoin Soars, Insurance Capacity Declines

Bitcoin gained about 40% in the quarter, its best performance since 2024. In contrast, the insurance capacity of the sector fell to $130.2 million at the end of August. It was still at $163.2 million a year earlier. This figure comes from CoinGecko's 2026 report on crypto security.

This amount covers less than 5% of the $2.68 billion stolen since January. Compensation has followed the same trend. Insurers have paid out only about $33 million between January 2025 and July 2026. This represents barely 0.9% of the $3.63 billion lost. The supply is also contracting. Five of the nine on-chain insurance protocols tracked by CoinGecko have closed or abandoned crypto coverage.

AI Accelerates Vulnerability Hunting

Nicolai Sondergaard, an analyst at Nansen, shared his diagnosis with CoinDesk. According to him, "the repeated exploits reinforce the idea that crypto infrastructure remains operationally fragile." Oliver Carding from Tesseract Group points to another accelerator. AI tools are now automating the search for vulnerabilities in smart contracts. This work used to take months for a seasoned engineer.

The list is already growing in October. NEAR Intents lost $3.8 million of user funds on October 1. The cause was a bug between the deposit and withdrawal infrastructure Omni and its smart contract. The protocol had blocked $50 million related to the Bitget hack just days earlier. It finally promises a full refund.

Gracy Chen currently refuses to quantify the frozen funds with the help of the sector. She first wants to verify them. Mandiant and SlowMist, mandated by Bitget, are still assessing the initial clues pointing towards North Korean hackers.