Crypto projects lost $1.18 billion across 107 security incidents in the third quarter of 2026, according to a new report from blockchain security firm Hacken. The total for July through September was 55% higher than in the second quarter, making the period one of the costliest quarters on record for digital-asset security. Hacken said the largest individual losses came from supply-chain attacks, compromised keys, and failures in signing and withdrawal infrastructure.

The report is an industry research product rather than a regulator's loss register, so its categories and totals reflect Hacken's methodology. Even with that limitation, the breakdown offers a useful view of where attackers found leverage. Smart-contract exploits accounted for 48% of reported losses, up from 12% in the previous quarter. Access-control and operational failures represented another 40%, down from 88% in Q2 but still a large share of the damage.

Related reporting: Bitget reports $351.6M hot-wallet breach and pauses withdrawals

Audit scope became the central issue

Independent reporting by CoinDesk found that $906.8 million, or 77% of the quarterly total, was connected to compromised suppliers or developer tools, publicly disclosed fixes that had not been installed, or components excluded from the most recent security review. That combination matters because a project can accurately say a specific smart contract was audited while wallets, signing systems, withdrawal controls or third-party software remain outside that review.

An audit therefore describes the code and systems examined at a particular time; it is not a guarantee that every component interacting with customer funds was covered or stayed unchanged. Hacken also reported that public security fixes preceded several high-profile exploits during the quarter. The finding points to a separate operational challenge: identifying available patches, assessing their urgency and deploying them before a known weakness is reused elsewhere.

Repeated weaknesses crossed different codebases

Hacken said the same classes of exploit continued to appear across different programming languages and codebases. That suggests teams cannot treat a review as a one-off milestone. Controls around software dependencies, deployment, privileged access and key management need continuing attention after code reaches production. The report's nearly even split between smart-contract losses and access or operational failures also shows why security work cannot stop at the on-chain contract layer.

The compliance portion of the report tracked global supervisory and enforcement actions and counted $450,000 in fines issued to crypto-asset service providers during the quarter. Hacken said regulators are increasingly testing whether controls work continuously rather than only at a single assessment point, and are placing more responsibility on founders and senior executives. Regulatory approaches vary by jurisdiction, so that figure should not be read as a complete measure of global enforcement activity.

What users and operators can verify

For users, an audit badge alone does not reveal the assessment date, exact scope, unresolved findings or whether reviewed code matches the deployed system. Those details are more informative than the badge by itself. For operators, the quarterly data support a broader inventory of anything that can move funds or change system economics, including suppliers, signing arrangements and administrative controls, followed by patch tracking and post-deployment monitoring.

The report does not establish that every unaudited component is vulnerable, nor does it predict losses in the next quarter. Its narrower conclusion is that Q3's largest security costs were not confined to newly discovered smart-contract bugs. Attackers repeatedly reached the surrounding infrastructure that narrow reviews may miss, turning audit scope and ongoing operations into central parts of the security question.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.