The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Crypto thefts surged in the third quarter of 2026, with a handful of unusually large incidents driving total losses close to $1.2 billion. Hacken counted $1.18 billion stolen across 107 incidents, a 55% increase from the second quarter. A separate CD Security dataset recorded $1.24 billion across 146 technical incidents; the different totals reflect differences in scope and classification, not a contradiction.
Bitget was the quarter’s largest named loss at approximately $387.5 million transferred to attacker-controlled addresses (later rounded by Bitget to about $388 million), followed by the Liquid Network exploit at about $320 million.
As an Amazon Associate I earn from qualifying purchases.
How much was stolen in the Bitget hack?
Bitget said unauthorized transfers began at approximately 18:31 UTC on September 24, 2026, from part of its hot- and warm-wallet infrastructure. Its investigation concluded that attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials. They then issued fraudulent withdrawal commands that bypassed the exchange’s existing risk controls.
The official investigation estimated that approximately $387.5 million in assets moved to attacker-controlled addresses across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON. A later Bitget protection-fund notice described the final affected amount as approximately $388 million. Bitget said the attack path had been identified, the underlying vulnerability remediated and the incident contained.
#1 Best Overall
Were Bitget user balances affected?
Bitget said user account balances remained accurate and unaffected. The exchange designated its Protection Fund to cover the financial impact and reported that the fund had been replenished to more than $300 million by September 30, 2026. That statement addresses account-balance coverage; it does not change the amount that was transferred during the incident.
The four incidents that dominated Q3 losses
A contemporaneous incident summary identified four events that together represented roughly 80% of the quarter’s losses. Their attack surfaces and loss measurements were not identical, so the figures should be read as incident estimates rather than a single standardized accounting method.
| Incident | Reported amount | Primary attack surface | Response or recovery noted |
|---|---|---|---|
| Bitget | About $387.5 million confirmed transferred; later rounded to about $388 million | Third-party security product, privileged credentials and withdrawal infrastructure | Vulnerability remediated; Protection Fund designated and replenished above $300 million |
| Liquid Network | About $320 million | Infrastructure and signer or key controls | About $272 million returned by self-described white hats |
| Tectonic | About $120 million | Reported in the incident summary as a major technical exploit | Specific recovery amount not stated in the summary |
| Coldcard firmware vulnerability | Estimated $115 million | Firmware and key-management exposure | Specific recovery amount not stated in the summary |
The concentration explains why the median incident was far smaller than the headline total: 98 of 107 incidents were below $10 million, and the median loss was reported as $670,000.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Why crypto hacks reached nearly $1.2 billion
Hacken described Q3 2026 as “one of the costliest quarters on record for digital asset security.” Its category breakdown assigned 48% of losses to smart-contract exploits and 40% to access-control and operational failures.
Smart-contract exploits remained a major category
Vulnerable contract logic, upgrade paths and interactions between protocols can still permit direct asset theft or manipulation. The 48% share means contract security remained the largest single category in Hacken’s breakdown, but it did not account for all major losses.
Privileged access and operational systems amplified damage
The Bitget incident illustrates how a weakness outside contract code can lead to a large loss: a third-party product vulnerability exposed high-level credentials, and withdrawal commands then bypassed controls. Hacken also identified supply-chain attacks, key compromises and failures in signer and withdrawal infrastructure among the largest single-incident drivers.
The practical lesson is that a passed smart-contract audit covers only one layer. Suppliers, developer tooling, oracles, bridges, custody systems, signing authorities, wallet firmware and deployment processes can each become decisive attack surfaces.
Why two reports give different Q3 totals
Hacken’s headline figure is $1.18 billion stolen in 107 incidents. CD Security’s separate Q3 report counted 146 incidents and $1.24 billion in like-for-like technical losses. CD Security said Bitget, Liquid Network and Tectonic represented about 67% of its total.
These figures use different incident populations and classification rules. Hacken’s number is the appropriate headline for the 107-incident theft count; CD Security’s broader technical-incident dataset captures additional events. Neither figure should be combined with the other or presented as a revised total without its methodology label.
Rank #4
Were the stolen funds recovered?
The incident summary reported that approximately $387 million, or about 33% of gross Q3 losses, was returned or reversed. Liquid Network accounted for about $272 million of that recovery: self-described white hats returned approximately 85% of the value stolen in that incident.
The same summary said operators covered about $410 million of user losses from their own funds, including Bitget’s Protection Fund coverage. It also reported approximately $384 million, or 32% of gross losses, neither returned nor covered.
Returned funds, reversals and operator-funded coverage are separate accounting categories that can overlap in incident reporting. The percentages therefore describe the summary’s reported treatment of losses, not a claim that every dollar was counted once in a single cash-flow ledger.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
What security teams should change after Q3
- Extend reviews beyond contract code: assess suppliers, signing services, wallet firmware, deployment tooling, bridges, oracles and withdrawal systems.
- Reduce credential impact: use least-privilege access, hardware-backed key management and independent approval for high-value transactions.
- Validate transactions independently: require out-of-band checks of destination addresses, amounts, asset types and network before signing.
- Monitor continuously: alert on unusual credential use, policy bypasses, new withdrawal destinations and abnormal transaction patterns.
- Prepare automated containment: test emergency withdrawal pauses, signer rotation, credential revocation and communication procedures before an incident.
- Review upgrades and dependencies: subject contract upgrades and third-party software changes to independent review, staged deployment and rollback plans.
- Use incentives and disclosure paths: maintain a bug-bounty process and clearly defined channels for researchers to report vulnerabilities.
Bitget’s account of its response is a reminder that rapid identification and remediation matter, but preventive controls must assume that a trusted supplier or privileged credential can fail.
What the Q3 numbers mean for crypto users
The quarter’s loss profile was highly concentrated: four incidents produced most of the damage while the typical incident was measured in hundreds of thousands, not hundreds of millions. Users should therefore distinguish between an exchange’s reported account balances, the gross value moved during an attack and the amount ultimately recovered or reimbursed.
For custodial accounts, check the platform’s stated recovery and protection-fund policy rather than assuming that an advertised reserve equals immediately available cash. For self-custody, security depends on the complete signing and device stack, including firmware, key storage and transaction verification—not only on whether the underlying smart contract was audited.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
