In its quarterly report, Hacken lists 107 incidents and $1.18 billion stolen in the third quarter of 2026 within the crypto sphere. It links 77% of that total to audit blind spots: a compromised crypto vendor, an undeployed patch, or a component not last reviewed. Only 14% of the losses were in the latter case and approximately $384 million was neither recovered nor covered.
In brief
- $1.18 billion stolen in 107 incidents in Q3 2026, or +55% on Q2, the basis of which only includes incidents of at least $250,000, according to Hacken.
- Eleven incidents out of 107 (i.e. 10%) account for 77% of losses, according to our calculations based on the Hacken report.
- About $384 million, or 32% of the total, was neither recovered nor covered by operators, according to Hacken.
What does a crypto audit cover in the face of the $1.18 billion stolen in the third quarter of 2026?
A crypto audit describes a perimeter at a given date which itself sells audits recalls Hacken in his Q3 2026 report. However, three avenues of attack concentrated $906.8 million. This represents 77% of losses, in just 11 incidents (table below).
The heaviest case is that of the Bitget crypto exchange. According to SlowMist and Mandiant, $387.5 million stolen on September 24, 2026 via the flaw in a third-party security product.
| Attack route | Loss | Incidents | Share of losses |
| Compromised vendor or development tool | $411.5 million | 2 | 35% |
| Public patch not deployed | $324.8 million | 4 | 28% |
| Component out of last review | $170.5 million | 5 | 14% |
Only the last route targets a component not reviewedat the rate of 170.5 million dollars. This represents 14% of losses. In this context, Tectonic weighs around 70%. According to our calculations, this equates to $120 million out of $170.5 million.
Hacken lists four crypto audits. On the other hand, the risk parameters used did not fall within the revised scope: $120.4 million was borrowed in one transaction.
An audit is a piece of evidence, not a legal refuge.
Krish Gosai, Gosai Law, Hacken Report on Q3 2026, October 2026
What does this assessment change for crypto investors?
THE balance sheet of $1.18 billion is a gross amount. It does not in any way measure the final loss of crypto users. According to Hacken:
- approximately $387 million was returned or canceled;
- approximately $410 million covered by operators (including $387.5 million from Bitget’s protection fund);
- approximately $384 million was neither recovered nor covered.
On the crypto regulation side, on July 8, 2026, ESMA launched a joint supervisory action on storage by providers approved under MiCA. National authorities will verify key management, crypto incident response as well as third-party dependencies. Hacken sees this as a change in model: crypto approval becomes the start of continuous supervision.
National controls continue until the first half of 2027, then ESMA will consolidate their results in a report to its board of supervisors in the second half of 2027. Until then, Hacken recommends that institutional crypto players retest their systems after each update, setting change or security alert.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
